TYPO3 Core

Implementation detail:

The new SVG sprites use xlink:href - e.g.:

<use xlink:href="/typo3/sysext/core/Resources/Public/Icons/T3Icons/sprites/apps.svg#apps-pagetree-page-shortcut-external />

However, xlink:href is deprecated:

• https://developer.mozilla.org/en-US/docs/Web/SVG/Attribute/xlink:href
• https://developer.mozilla.org/en-US/docs/Web/SVG/Element/use#Attributes

Without having it tested... the only work-around for this seems to weaken default-src, but restrict remaining fetch directives.

Any token/hash based grant probably would not work with inline SVGs.

# Fetch directives
Content-Security-Policy: default-src 'self'; connect-src 'self'
Content-Security-Policy: font-src 'self'; img-src 'self' data:
Content-Security-Policy: script-src 'self' 'unsafe-inline' 'unsafe-eval'
Content-Security-Policy: style-src 'self' 'unsafe-inline'
Content-Security-Policy: frame-src 'self'; frame-ancestors 'self'

# note: media-src was missing, probably should be 'self' instead for a CMS
Content-Security-Policy: child-src 'none'; object-src 'none'; media-src 'none'

# W3C working draft directives
Content-Security-Policy: prefetch-src 'none'; worker-src 'none'

# Document & Navigate directives
Content-Security-Policy: base-uri 'self'; form-action 'self'; manifest-src 'self'

given policy in report

Content-Security-Policy:
  default-src 'none'; connect-src 'self';
  font-src 'self'; img-src 'self' data:;
  script-src 'self' 'unsafe-inline' 'unsafe-eval';
  style-src 'self' 'unsafe-inline';
  frame-src 'self'; frame-ancestors 'self';

  object-src 'none';

  base-uri 'self'; form-action 'self'; manifest-src 'self'

Tested the following CSP settings in a TYPO3 backend of version 11:

Content-Security-Policy: default-src 'self'; img-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src-attr 'unsafe-inline'; style-src-elem 'self' 'unsafe-inline'; frame-src 'self'; child-src 'none'; object-src 'none'; prefetch-src 'none'; worker-src 'self' blob:;

Side notes:

• script-src
  • unsafe-eval was removed
  • unsafe-inline is still kept due to CKEditor v4 doing inline magic (basically not using DOM operations, but using document.write)
• worker-src
  • blob: allowed for muuri.js which is used in the Dashboard view
• default-src
  • weakened from none to self
  • adjusted child-src, object-src and prefect-src to keep none

There's still a lot of things to do for applying real secure CSP settings for the TYPO3 backend (the initially reported rules are not considered secure due to unsafe-eval and unsafe-inline). Please let me know whether the adjusted CSP above fits your needs for the time being. Thanks in advance!