docsifyjs / docsifyjs/docsify

Ensure that HTML assignments are done through TrustedHTML

Đang mở
#1,877 4 bình luận 0 reaction 0 người được giao Xem trên GitHub
Ngôn ngữ chính
JavaScript
Star
31.5k
Fork
5.8k
Merge trung bình
9 ngày 8 giờ
Pull request đã merge (30 ngày)
2

Mô tả

## Bug Report

When using a content security policy (see policy below), I get an error like this:

```
docsify.js:8535 This document requires 'TrustedHTML' assignment.
_renderTo @ docsify.js:8535
initRender @ docsify.js:8729
Docsify @ docsify.js:9247
(anonymous) @ docsify.js:9277

docsify.js:8535
Uncaught TypeError: Failed to set the 'outerHTML' property on 'Element': This document requires 'TrustedHTML' assignment.
at Docsify._renderTo (docsify.js:8535:53)
at Docsify.initRender (docsify.js:8729:16)
at new Docsify (docsify.js:9247:12)
at HTMLDocument. (docsify.js:9277:39)
```

If I remove the trused type policy from the header I still get this error:

```
docsify.js:8535

Refused to apply inline style because it violates the following Content Security Policy directive: "style-src cdn.jsdelivr.net 'self' ". Either the 'unsafe-inline' keyword, a hash ('sha256-6h52w3SLKvExCLgdk907pJwQu8hZtVM4QMirrrfKGaI='), or a nonce ('nonce-...') is required to enable inline execution. Note that hashes do not apply to event handlers, style attributes and javascript: navigations unless the 'unsafe-hashes' keyword is present.
```

Line 8535 is an assignment to innerHTML/outerHTML adding a SHA to script tag generated by docsify internals is not possibility.

#### Steps to reproduce

Enable custom response headers on your server. Use the following Content Security Policy:
```
Content-Security-Policy: prefetch-src 'self'; script-src cdn.jsdelivr.net 'self'; style-src cdn.jsdelivr.net 'self'; img-src data: 'self' static.addtoany.com; font-src data: 'self'; manifest-src 'self'; default-src 'none'; base-uri 'self'; frame-ancestors 'none'; trusted-types dompurify; require-trusted-types-for 'script';
```

#### What is current behaviour

Errors as shown above.

#### What is the expected behaviour

Docsify should work normally irrespective of CSP header.

#### Other relevant information

The system information is irrelevant here (I have tested this on Cloudflare pages server, server used is probably more pertinent)

- Your OS:
- Node.js version: 18.8.0
- npm/yarn version:
- Browser version:
- Docsify version: 4.12.2
- Docsify plugins:

#### Please create a reproducible sandbox

I would but I am not sure how to simulate/modify HTTP headers in a sandbox!

Hướng dẫn đóng góp

Mở hướng dẫn đóng góp

Đánh giá

Issue này chưa được đánh giá.

Nhận issue mới trong hộp thư của bạn

Bản tóm tắt ngắn những issue GitHub phù hợp với người mới.