magento / magento/security-package
Recaptcha Newsletter still uses inline scripts --> CSP warnings
- Dominant language
- PHP
- Stars
- 75
- Forks
- 73
- PR merge metrics
- No merged PRs in 30d
Description
### Preconditions (*)
1.Magento 2.4.7-p1
2.Default CSP config and whitelisting, no customizations. Please notice that default CSP policies blocks inline scripts in the checkout page.
3.Block for newsletter signup is shown in every page, including checkout. Block has a recaptcha validation.
### Steps to reproduce (*)
1.Go to checkout.
2.Check browser console.
3.Notice the CSP warnings, attached screenshots in the following points.
### Expected result (*)
1. Module should use the rendertag function to deal with CSP default requirements, instead of inserting inline scripts. This would allow the script to be executed.
2. No warnings should be shown by CSP policies in the browser console.
### Actual result (*)
1. Module is inserting inline scripts, detected by the CSP policies and generating unwanted warnings.


2.This is ocurring because of the following code:

Contributor guide
Research direction
Start by reproducing the checkout page with the newsletter signup and Recaptcha block, then inspect the code that inserts the inline scripts. Compare that path with the mentioned renderTag function and Magento's default CSP requirements. The work is done when checkout no longer produces CSP warnings for the newsletter Recaptcha scripts.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- php
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 40/100