docsifyjs / docsifyjs/docsify

Ensure that HTML assignments are done through TrustedHTML

Open
#1,877 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
JavaScript
Stars
31.5k
Forks
5.8k
Avg merge
9d 8h
Merged PRs (30d)
2

Description

## Bug Report

When using a content security policy (see policy below), I get an error like this:

```
docsify.js:8535 This document requires 'TrustedHTML' assignment.
_renderTo @ docsify.js:8535
initRender @ docsify.js:8729
Docsify @ docsify.js:9247
(anonymous) @ docsify.js:9277

docsify.js:8535
Uncaught TypeError: Failed to set the 'outerHTML' property on 'Element': This document requires 'TrustedHTML' assignment.
at Docsify._renderTo (docsify.js:8535:53)
at Docsify.initRender (docsify.js:8729:16)
at new Docsify (docsify.js:9247:12)
at HTMLDocument. (docsify.js:9277:39)
```

If I remove the trused type policy from the header I still get this error:

```
docsify.js:8535

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src cdn.jsdelivr.net 'self' ". Either the 'unsafe-inline' keyword, a hash ('sha256-6h52w3SLKvExCLgdk907pJwQu8hZtVM4QMirrrfKGaI='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
```

Line 8535 is an assignment to innerHTML/outerHTML adding a SHA to script tag generated by docsify internals is not possibility.

#### Steps to reproduce

Enable custom response headers on your server. Use the following Content Security Policy:
```
Content-Security-Policy: prefetch-src 'self'; script-src cdn.jsdelivr.net 'self'; style-src cdn.jsdelivr.net 'self'; img-src data: 'self' static.addtoany.com; font-src data: 'self'; manifest-src 'self'; default-src 'none'; base-uri 'self'; frame-ancestors 'none'; trusted-types dompurify; require-trusted-types-for 'script';
```

#### What is current behaviour

Errors as shown above.

#### What is the expected behaviour

Docsify should work normally irrespective of CSP header.

#### Other relevant information

The system information is irrelevant here (I have tested this on Cloudflare pages server, server used is probably more pertinent)

- Your OS:
- Node.js version: 18.8.0
- npm/yarn version:
- Browser version:
- Docsify version: 4.12.2
- Docsify plugins:

#### Please create a reproducible sandbox

I would but I am not sure how to simulate/modify HTTP headers in a sandbox!

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.