docsifyjs / docsifyjs/docsify

Ensure that HTML assignments are done through TrustedHTML

Abierto
#1,877 4 comentarios 0 reacciones 0 asignados Ver en GitHub
Lenguaje dominante
JavaScript
Estrellas
31.5k
Forks
5.8k
Merge medio
9 d 8 h
PR fusionados (30 d)
2

Descripción

## Bug Report

When using a content security policy (see policy below), I get an error like this:

```
docsify.js:8535 This document requires 'TrustedHTML' assignment.
_renderTo @ docsify.js:8535
initRender @ docsify.js:8729
Docsify @ docsify.js:9247
(anonymous) @ docsify.js:9277

docsify.js:8535
Uncaught TypeError: Failed to set the 'outerHTML' property on 'Element': This document requires 'TrustedHTML' assignment.
at Docsify._renderTo (docsify.js:8535:53)
at Docsify.initRender (docsify.js:8729:16)
at new Docsify (docsify.js:9247:12)
at HTMLDocument. (docsify.js:9277:39)
```

If I remove the trused type policy from the header I still get this error:

```
docsify.js:8535

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src cdn.jsdelivr.net 'self' ". Either the 'unsafe-inline' keyword, a hash ('sha256-6h52w3SLKvExCLgdk907pJwQu8hZtVM4QMirrrfKGaI='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
```

Line 8535 is an assignment to innerHTML/outerHTML adding a SHA to script tag generated by docsify internals is not possibility.

#### Steps to reproduce

Enable custom response headers on your server. Use the following Content Security Policy:
```
Content-Security-Policy: prefetch-src 'self'; script-src cdn.jsdelivr.net 'self'; style-src cdn.jsdelivr.net 'self'; img-src data: 'self' static.addtoany.com; font-src data: 'self'; manifest-src 'self'; default-src 'none'; base-uri 'self'; frame-ancestors 'none'; trusted-types dompurify; require-trusted-types-for 'script';
```

#### What is current behaviour

Errors as shown above.

#### What is the expected behaviour

Docsify should work normally irrespective of CSP header.

#### Other relevant information

The system information is irrelevant here (I have tested this on Cloudflare pages server, server used is probably more pertinent)

- Your OS:
- Node.js version: 18.8.0
- npm/yarn version:
- Browser version:
- Docsify version: 4.12.2
- Docsify plugins:

#### Please create a reproducible sandbox

I would but I am not sure how to simulate/modify HTTP headers in a sandbox!

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.