docsifyjs / docsifyjs/docsify

Ensure that HTML assignments are done through TrustedHTML

Offen
#1,877 4 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
JavaScript
Sterne
31.5k
Forks
5.8k
Ø Merge
9 T. 8 Std.
Gemergte PRs (30 T.)
2

Beschreibung

## Bug Report

When using a content security policy (see policy below), I get an error like this:

```
docsify.js:8535 This document requires 'TrustedHTML' assignment.
_renderTo @ docsify.js:8535
initRender @ docsify.js:8729
Docsify @ docsify.js:9247
(anonymous) @ docsify.js:9277

docsify.js:8535
Uncaught TypeError: Failed to set the 'outerHTML' property on 'Element': This document requires 'TrustedHTML' assignment.
at Docsify._renderTo (docsify.js:8535:53)
at Docsify.initRender (docsify.js:8729:16)
at new Docsify (docsify.js:9247:12)
at HTMLDocument. (docsify.js:9277:39)
```

If I remove the trused type policy from the header I still get this error:

```
docsify.js:8535

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src cdn.jsdelivr.net 'self' ". Either the 'unsafe-inline' keyword, a hash ('sha256-6h52w3SLKvExCLgdk907pJwQu8hZtVM4QMirrrfKGaI='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
```

Line 8535 is an assignment to innerHTML/outerHTML adding a SHA to script tag generated by docsify internals is not possibility.

#### Steps to reproduce

Enable custom response headers on your server. Use the following Content Security Policy:
```
Content-Security-Policy: prefetch-src 'self'; script-src cdn.jsdelivr.net 'self'; style-src cdn.jsdelivr.net 'self'; img-src data: 'self' static.addtoany.com; font-src data: 'self'; manifest-src 'self'; default-src 'none'; base-uri 'self'; frame-ancestors 'none'; trusted-types dompurify; require-trusted-types-for 'script';
```

#### What is current behaviour

Errors as shown above.

#### What is the expected behaviour

Docsify should work normally irrespective of CSP header.

#### Other relevant information

The system information is irrelevant here (I have tested this on Cloudflare pages server, server used is probably more pertinent)

- Your OS:
- Node.js version: 18.8.0
- npm/yarn version:
- Browser version:
- Docsify version: 4.12.2
- Docsify plugins:

#### Please create a reproducible sandbox

I would but I am not sure how to simulate/modify HTTP headers in a sandbox!

Beitragsleitfaden

Beitragsleitfaden öffnen

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.