magento / magento/security-package

Recaptcha Newsletter still uses inline scripts --> CSP warnings

Open
#337 2 comments 0 reactions 0 assignees View on GitHub
Progress: ready for grooming
Dominant language
PHP
Stars
75
Forks
73
PR merge metrics
No merged PRs in 30d

Description

### Preconditions (*)

1.Magento 2.4.7-p1
2.Default CSP config and whitelisting, no customizations. Please notice that default CSP policies blocks inline scripts in the checkout page.
3.Block for newsletter signup is shown in every page, including checkout. Block has a recaptcha validation.

### Steps to reproduce (*)

1.Go to checkout.
2.Check browser console.
3.Notice the CSP warnings, attached screenshots in the following points.

### Expected result (*)

1. Module should use the rendertag function to deal with CSP default requirements, instead of inserting inline scripts. This would allow the script to be executed.
2. No warnings should be shown by CSP policies in the browser console.

### Actual result (*)

1. Module is inserting inline scripts, detected by the CSP policies and generating unwanted warnings.
![image](https://github.com/user-attachments/assets/1324fe3a-923f-49cc-8d1b-ddc46e909b2e)
![image](https://github.com/user-attachments/assets/6646029b-9099-4338-ade3-c021a5994d76)

2.This is ocurring because of the following code:
![image](https://github.com/user-attachments/assets/9738819b-64db-429b-8ce1-3c79de444dfe)

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the checkout page with the newsletter signup and Recaptcha block, then inspect the code that inserts the inline scripts. Compare that path with the mentioned renderTag function and Magento's default CSP requirements. The work is done when checkout no longer produces CSP warnings for the newsletter Recaptcha scripts.

Written by the indexing model from the issue text.

Assessment

Tech stack
php
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
40/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.