Project

General

Profile

Actions
Copy link

Bug #102323

closed

CSP issues in BE ckeditor5

Added by Claus Harup about 1 year ago. Updated 6 months ago.

Status:
Closed
Priority:
Should have
Assignee:
-
Category:
RTE (rtehtmlarea + ckeditor)
Target version:
-
Start date:
2023-11-06
Due date:
% Done:

0%

Estimated time:
TYPO3 Version:
12
PHP Version:
8.2
Tags:
csp
Complexity:
Is Regression:
Sprint Focus:

Description

In Firefox I get the following CSP error - only in Firefox

Files

Download all files
clipboard-202311061210-2iknz.png (72.9 KB) clipboard-202311061210-2iknz.png Claus Harup, 2023-11-06 11:10
clipboard-202311061214-ozryz.png (61.4 KB) clipboard-202311061214-ozryz.png Claus Harup, 2023-11-06 11:14
clipboard-202311061215-jo2cc.png (61.4 KB) clipboard-202311061215-jo2cc.png Claus Harup, 2023-11-06 11:15
clipboard-202311061219-dctfc.png (76.4 KB) clipboard-202311061219-dctfc.png Claus Harup, 2023-11-06 11:19
12.4.7-macos-chrome.png (571 KB) 12.4.7-macos-chrome.png Oliver Hader, 2023-11-06 12:23
clipboard-202311061345-dwrvz.png (73.9 KB) clipboard-202311061345-dwrvz.png Claus Harup, 2023-11-06 12:45
clipboard-202311061351-zlzab.png (115 KB) clipboard-202311061351-zlzab.png Claus Harup, 2023-11-06 12:51

Related issues 1 (1 open — 0 closed)

Related to TYPO3 Core - Bug #105848: CKEditor inspector creates CSP errors + (sometimes) breaks IRRE records (Firefox)New2024-12-19

Actions
Actions
Copy link
 #1

Updated by Claus Harup about 1 year ago

UPDATE: It is not only firefox

Actions
Copy link
 #2

Updated by Oliver Hader about 1 year ago

  • Category changed from Security to RTE (rtehtmlarea + ckeditor)
  • Assignee deleted (Oliver Hader)
  • Target version deleted (next-patchlevel)

I'm not sure why CKEditor5 needs to eval code there...

Actions
Copy link
 #3

Updated by Oliver Hader about 1 year ago

  • Status changed from New to Needs Feedback

Hm. I was not able to reproduce that with the recent state of the v12.4 branch. Which TYPO3 version/commit are you using?

Actions
Copy link
 #4

Updated by Claus Harup about 1 year ago

TYPO3 v.12.4.7

Actions
Copy link
 #5

Updated by Oliver Hader about 1 year ago

  • File Screenshot 2023-11-06 at 12.44.21.png added

I was not able to reproduce that in TYPO3 v12.4.7, using the YAML setting editor.config.debug: true to enable the inspector.

Actions
Copy link
 #6

Updated by Oliver Hader about 1 year ago

  • File deleted (Screenshot 2023-11-06 at 12.44.21.png)
Actions
Copy link
 #8

Updated by Oliver Hader about 1 year ago

Can you provide a script snippet that causes this problem (either by clicking in the console, or it also might be logged in the TYPO3 CSP backend module). It is possible, that browser plugins (e.g. VueJS devtools or similar) are causing these kind of violations...

Actions
Copy link
 #10

Updated by Oliver Hader about 1 year ago

Thx. At least I can confirm the implicit eval is in the bundled JavaScript code. The reason seems to be a bundling issue with WebPack and the lack of having a dedicated ES6 module.

Actions
Copy link
 #11

Updated by Oliver Hader about 1 year ago

  • Status changed from Needs Feedback to Accepted
Actions
Copy link
 #12

Updated by Oliver Hader about 1 year ago

  • Subject changed from CSP issues in BE ckeditor - only in firefox to CSP issues in BE ckeditor5
Actions
Copy link
 #13

Updated by Georg Ringer 7 months ago

  • Status changed from Accepted to Resolved

author states that it is fixed, therefore closing issue

Actions
Copy link
 #14

Updated by Benni Mack 6 months ago

  • Status changed from Resolved to Closed
Actions
Copy link
 #15

Updated by Garvin Hicking 26 days ago

  • Related to Bug #105848: CKEditor inspector creates CSP errors + (sometimes) breaks IRRE records (Firefox) added
Actions
Copy link

Also available in: Atom PDF