TYPO3 Core

This extends to inline scripts and styles added using the `f:asset.script` and `f:asset.css` ViewHelpers, e.g. these two will be blocked by the CSP:

<f:asset.script identifier="helloWorld">
  console.log("Hello world!")
</f:asset.script>
<f:asset.css identifier="helloWorld">
  body { max-width: 1200px; margin: 0 auto; }
</f:asset.css>

Issue #100732 introduced the boolean attribute useNonce, e.g.

<f:asset.script useNonce="1">console.log('Hello World');</f:asset.script>

The tag attribute nonce would allow to define a static value (which is not suggested from a security point of view). The {f:security.nonce()} could be used to retrieve the current dynamic nonce value for the whole request, which seems to be too complicated. Thus, the tag attribute nonce might be deprecated & removed with TYPO3 v13.

<f:asset.script nonce="static-nonce-value">console.log('Hello World');</f:asset.script>
<f:asset.script nonce="{f:security.nonce()}">console.log('Hello World');</f:asset.script>

We can confirm that the nonce value is not getting generated automatically like mentioned in the docs for "jsInline". (the docs say "The nonce is applied automatically, when scripts or styles are defined with the TYPO3 API, like TypoScript (page.includeJS, etc.) or the asset collector.")

Automatically applying CSP nonce or hash values to INLINE scripts or stylesheets is actually dangerous and should be done explicitly. Anything that is a static resource should get their nonce or hash value automatically.

Denis Mir wrote in #note-6:

We can confirm that the nonce value is not getting generated automatically like mentioned in the docs for "jsInline". (the docs say "The nonce is applied automatically, when scripts or styles are defined with the TYPO3 API, like TypoScript (page.includeJS, etc.) or the asset collector.")

The docs at https://docs.typo3.org/m/typo3/reference-coreapi/12.4/en-us/ApiOverview/ContentSecurityPolicy/Index.html are not mentioning jsInline at all...

Anyway, it might be more specific, that inline scripts and stylesheets via TypoScript are not added automatically. Feed free to create a new issue at https://github.com/TYPO3-Documentation/TYPO3CMS-Reference-CoreApi

Oliver Hader wrote in #note-7:

Automatically applying CSP nonce or hash values to INLINE scripts or stylesheets is actually dangerous and should be done explicitly. Anything that is a static resource should get their nonce or hash value automatically.

Dangerous how? And how should I include not static resources in a safe way?

Oliver Hader wrote in #note-8:

Anyway, it might be more specific, that inline scripts and stylesheets via TypoScript are not added automatically. Feed free to create a new issue at https://github.com/TYPO3-Documentation/TYPO3CMS-Reference-CoreApi

If inline scripts and stylesheets via TypoScript are broken with frontend CSP, this should be explicitly stated in the TypoScript Reference.

If automatically applying a nonce to inline resources is dangerous, imho either there should be a way to add it by configuration (ie page.inlineSettings.addNonce = 1), or inline resources via TS should be deprecated and removed.

I think this is about using:

<script>
Alert('inline!')
</script>

this is considered unsafe. Including foreign files, or creating external files on the fly is still supported and not removed; it's not broken per se, especially if CSPs are not used.

So the way above is also still possible, just not when also using CSP AND TypoScript. So one has to be a bit more restrictive with how to use it. I don't think TYPO3 will allow to define inline scripts (not inline script references!) currently, because generally it should be avoided now to have "random" javascript inside the DOM.

I hoped to have phrased that in the docs PR. Please feel free to correct me if I understood something wrong.

Garvin Hicking wrote in #note-12:

I think this is about using:

<script>
Alert('inline!')
</script>

this is considered unsafe.

That's why I want to use

<script nonce="XXX">alert('safe inline code');</script>

That's why I want to use

<script nonce="XXX">alert('safe inline code');</script>

Yes, but this is not done automatically because it's not a recommended best practice and is not encouraged, that is IMO what Oliver tried to express, and I tried to forward to the docs. You need to specify the nonce yourself for this - or try to find better ways to no longer need inline javascript (DOM/data-Attributes to HTML nodes, external javascript operating on this). Nonces are only auto-added for file references, because that is deemed "better".

Garvin Hicking wrote in #note-14:

That's why I want to use

<script nonce="XXX">alert('safe inline code');</script>

Yes, but this is not done automatically because it's not a recommended best practice and is not encouraged, that is IMO what Oliver tried to express, and I tried to forward to the docs.

I got that, so I asked for a pointer, why inline code with nonce is deemed dangerous.

You need to specify the nonce yourself for this - or try to find better ways to no longer need inline javascript (DOM/data-Attributes to HTML nodes, external javascript operating on this). Nonces are only auto-added for file references, because that is deemed "better".

I am aware of the methods to include the nonce myself, like FLUIDTEMPLATE in headerData with the security.nonce viewhelper or TEXT with data = request : nonce | value. But this is more hassle than a simple page.inlineSettings.a = b.

So I proposed there should either be a simple way to include the nonce manually, or this behaviour should be documented in the TSref and all inline methods should be deprecated. Which one depends on the why-question above ...