Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update inline javascript tags to comply with CSP after the 2.4.7 magento release. #87

Open
wants to merge 1 commit into
base: release/2.2.2
Choose a base branch
from

Conversation

freak3dot
Copy link

This pull request uses $secureRenderer->renderTag in place of inline JavaScript <script> tags to comply with restrict-mode being the default on payment pages. Please note that unsafe-inline has also been removed from payment pages in Magento 2.4.7.

You can read more about it here:
https://developer.adobe.com/commerce/php/development/security/content-security-policies/
https://developer.adobe.com/commerce/php/development/security/content-security-policies/#default-configuration

This is the specific fix: https://developer.adobe.com/commerce/php/development/security/content-security-policies/#inside-a-phtml-template

Though this fixes the inline JavaScript in this extension, it does not fix the downstream issue with the inline JavaScript tags returned from certexpress.com.

@freak3dot
Copy link
Author

In Adobe Commerce and Magento Open Source version 2.4.7 and later, CSP is configured in restrict-mode by default for payment pages in the storefront and admin areas, and in report-only mode for all other pages. The corresponding CSP header does not contain the unsafe-inline keyword inside the script-src directive for payment pages. Also, only whitelisted inline scripts are allowed.

Prior to version 2.4.7, CSP was configured in report-only mode for all pages.

Souce: https://developer.adobe.com/commerce/php/development/security/content-security-policies/#default-configuration

Please note this pull request is specifically to whitelist the inline scripts in this extension that are no longer allowed due to the removal of the unsafe-inline keyword.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant