Project

General

Profile

Actions
Copy link

Bug #101169

closed

Admin panel does not allow usage of "nonce"

Added by Timo Webler 10 months ago. Updated 10 months ago.

Status:
Resolved
Priority:
Should have
Assignee:
-
Category:
AdminPanel
Target version:
-
Start date:
2023-06-26
Due date:
% Done:

100%

Estimated time:
TYPO3 Version:
12
PHP Version:
8.1
Tags:
Complexity:
Is Regression:
Sprint Focus:

Description

Within https://github.com/TYPO3/typo3/blob/ae6b8e0dc7788d4d5a278346f6a8cc7671faff55/typo3/sysext/adminpanel/Classes/Utility/ResourceUtility.php#L77 the nonce is not used.

So you can not use value strict-dynamic for script-src and must 'self'.

Addionally the the package symfony/var-dumper add inline js which also not add respect the nonce value.

The csp error:

Steps to reproduce:

  • Login in the TYPO3 backend
  • Activate feature security.frontend.enforceContentSecurityPolicy
  • Open the frontend with active admin panel
  • Activate the admin panel
  • See errors within browser log or within the new csp module

Files

clipboard-202306261622-fthg5.png (14.2 KB) clipboard-202306261622-fthg5.png Timo Webler, 2023-06-26 14:22

Related issues 1 (0 open — 1 closed)

Is duplicate of TYPO3 Core - Bug #100456: Don't report AdminPanel usages to CSPResolved2023-04-05

Actions
Actions
Copy link
 #1

Updated by Oliver Hader 10 months ago

  • Is duplicate of Bug #100456: Don't report AdminPanel usages to CSP added
Actions
Copy link
 #2

Updated by Oliver Hader 10 months ago

symfony/var-dumper is fixed with https://review.typo3.org/c/Packages/TYPO3.CMS/+/79204

How can one reproduce the the issue with ResourceUtility?

Actions
Copy link
 #3

Updated by Timo Webler 10 months ago

Oliver Hader wrote in #note-2:

symfony/var-dumper is fixed with https://review.typo3.org/c/Packages/TYPO3.CMS/+/79204

How can one reproduce the the issue with ResourceUtility?

Use strict-dynamic for script-src instead of self

Refused to load the script 'https://typo3-cms-standard.ddev.site/_assets/0304760f2d5b5a1f133ce43f8d460a02/JavaScript/admin-panel.js' because it violates the following Content Security Policy directive: "script-src-elem 'nonce-k-SiMsIDgLSoLjELO_m8amYQQE2JIcoxoYYGP0S83Xw585n61BwqgQ' 'strict-dynamic' 'report-sample'".
Actions
Copy link
 #4

Updated by Oliver Hader 10 months ago

Thx & Confirmed in the markup as well:

<!-- TYPO3 admin panel start -->
<link rel="stylesheet" href="/typo3/sysext/adminpanel/Resources/Public/Css/adminpanel.css" media="all" />
<script src="/typo3/sysext/adminpanel/Resources/Public/JavaScript/admin-panel.js"></script>
Actions
Copy link
 #5

Updated by Oliver Hader 10 months ago

  • Status changed from New to Accepted
Actions
Copy link
 #6

Updated by Gerrit Code Review 10 months ago

  • Status changed from Accepted to Under Review

Patch set 1 for branch main of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/79494

Actions
Copy link
 #7

Updated by Oliver Hader 10 months ago

With the patch applied, it would be like this:

<!-- TYPO3 admin panel start -->
<link nonce="S8eqSZNcg6zdwzFoGisL0MYRQZ-Ki-8SHjhrO7iRTYK5FSXxv5X7zw" rel="stylesheet" media="all" href="/typo3/sysext/adminpanel/Resources/Public/Css/adminpanel.css" />
<script nonce="S8eqSZNcg6zdwzFoGisL0MYRQZ-Ki-8SHjhrO7iRTYK5FSXxv5X7zw" src="/typo3/sysext/adminpanel/Resources/Public/JavaScript/admin-panel.js"></script>
Actions
Copy link
 #8

Updated by Gerrit Code Review 10 months ago

Patch set 1 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/79520

Actions
Copy link
 #9

Updated by Oliver Hader 10 months ago

  • Status changed from Under Review to Resolved
  • % Done changed from 0 to 100
Actions
Copy link
 #10

Updated by Gerrit Code Review 10 months ago

  • Status changed from Resolved to Under Review

Patch set 2 for branch 12.4 of project Packages/TYPO3.CMS has been pushed to the review server.
It is available at https://review.typo3.org/c/Packages/TYPO3.CMS/+/79520

Actions
Copy link
 #11

Updated by Oliver Hader 10 months ago

  • Status changed from Under Review to Resolved
Actions
Copy link

Also available in: Atom PDF