CSP blocked loading resource at inline script-src error in Firefox. #12724

artfulrobot · 2018-11-29T10:24:25Z

Steps to reproduce

Load the main nextcloud page. (i.e. All Files)

Expected behaviour

Page to load without errors in console.

Actual behaviour

Get this error in Firefox's web console: (Firefox 64 https://whatismybrowser.com/w/DSQGWHK)

Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").

Nb. this does not happen in Chromium.

Server configuration detail

Operating system: Linux 4.9.0-8-amd64 #1 SMP Debian 4.9.110-3+deb9u6 (2018-10-08) x86_64

Webserver: Apache/2.4.25 (Debian) (apache2handler)

Database: mysql 10.1.26

PHP version:

7.0.30-0+deb9u1
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, apache2handler, mysqlnd, PDO, xml, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, json, exif, mcrypt, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache, xdebug

Nextcloud version: 14.0.4 - 14.0.4.2

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

Signing status

Array
(
)

List of activated apps

Enabled:
 - accessibility: 1.0.1
 - activity: 2.7.0
 - bookmarks: 0.14.2
 - bookmarks_fulltextsearch: 1.0.0
 - bruteforcesettings: 1.2.0
 - cloud_federation_api: 0.0.1
 - comments: 1.4.0
 - contacts: 2.1.7
 - dav: 1.6.0
 - deck: 0.5.0
 - federatedfilesharing: 1.4.0
 - federation: 1.4.0
 - files: 1.9.0
 - files_external: 1.5.0
 - files_linkeditor: 1.0.7
 - files_markdown: 2.0.5
 - files_mindmap: 0.0.10
 - files_pdfviewer: 1.3.2
 - files_rightclick: 0.8.4
 - files_sharing: 1.6.2
 - files_texteditor: 2.6.0
 - files_trashbin: 1.4.1
 - files_versions: 1.7.1
 - files_videoplayer: 1.3.0
 - firstrunwizard: 2.3.0
 - fulltextsearch: 1.1.0
 - gallery: 18.1.0
 - issuetemplate: 0.4.0
 - logreader: 2.0.0
 - lookup_server_connector: 1.2.0
 - mail: 0.11.0
 - news: 13.0.3
 - nextcloud_announcements: 1.3.0
 - notes: 2.5.0
 - notifications: 2.2.1
 - oauth2: 1.2.1
 - ownpad: 0.6.8
 - password_policy: 1.4.0
 - polls: 0.8.3
 - provisioning_api: 1.4.0
 - serverinfo: 1.4.0
 - sharebymail: 1.4.0
 - spreed: 4.0.1
 - support: 1.0.0
 - survey_client: 1.2.0
 - systemtags: 1.4.0
 - tasks: 0.9.8
 - twofactor_backupcodes: 1.3.1
 - updatenotification: 1.4.1
 - workflowengine: 1.4.0
Disabled:
 - admin_audit
 - encryption
 - theming
 - user_external
 - user_ldap

Configuration (config/config.php)

{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "**removed**"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "overwrite.cli.url": "https:\/\/**removed**\/nextcloud",
    "dbtype": "mysql",
    "version": "14.0.4.2",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "htaccess.RewriteBase": "\/nextcloud",
    "overwritewebroot": "\/nextcloud",
    "theme": "",
    "loglevel": 2,
    "maintenance": false,
    "updater.release.channel": "stable",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpmode": "smtp",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "updater.secret": "***REMOVED SENSITIVE VALUE***"
}

Are you using external storage, if yes which one: local/smb/sftp/...

Are you using encryption:

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...

Client configuration

Browser: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0

Operating system: Ubuntu 18.04

Logs

Browser log

Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").
files:1:1
JQMIGRATE: Migrate is installed, version 1.4.0 core.js:7:542
window.controllers/Controllers is deprecated. Do not use it for UA detection. merged.js:2176

Nextcloud log

N/A?

Browser log

Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").
files:1:1
JQMIGRATE: Migrate is installed, version 1.4.0 core.js:7:542
window.controllers/Controllers is deprecated. Do not use it for UA detection. merged.js:2176

The text was updated successfully, but these errors were encountered:

nextcloud-bot · 2018-11-29T10:43:18Z

GitMate.io thinks possibly related issues are #8358 (CSP is blocking font in data:), #2791 (CSP blocks path from server?), #11035 (CSP child-src is deprecated), #10489 (Warnings and errors in Firefox console), and #10254 (File Download CSP Error).

artfulrobot · 2018-11-29T14:32:19Z

Dear bot, this does look like the first of the 2 errors shown in #10489 but that bug was closed off for an earlier version. I'm seeing the error in latest stable 14.0.4. I'm running nextcloud in a directory https://example.com/nextcloud/ (if that makes a difference).

I'm not concerned about the warnings, but the error suggests, well, an error!

ChristophWurst · 2018-11-29T22:00:32Z

What specific resource was blocked? Is it possible this is one of your extensions that tries to inject a script? I'm pretty sure this is the case because I see that too occasionally (e.g. with the Vue dev tools).

artfulrobot · 2018-11-30T09:30:55Z

@ChristophWurst Hmmm, I don't know, I posted all the info there was from the console log.

I have been through my apps, disabling them one by one and reloading the main page after disabling to check for the error. The error persisted throughout. Here's the full list of apps I disabled:

notes
accessibility
activity
bookmarks
brute force
comments
contacts
deck
deleted files
external storage
federation
file sharing
files right click
first run wizard
full text search
full text search bookmarks
gallery
issue template
link editor
log reader
mail
markdown editor
mind map
monitoring
news
nextcloud announcements
notifications
ownpad
password policy
pdf viewer
polls
share by mail
support
talk
tasks
text editor
update notification
versions
video player

ChristophWurst · 2018-11-30T09:34:13Z

Okay, sorry for not being more specific. With extension I don't mean Nextcloud apps but browser extensions. Could you try with a fresh profile on Firefox or another browser like Chrome?

artfulrobot · 2018-11-30T09:39:41Z

Dang, you're right! With a fresh profile it doesn't happen. OK, this is clearly a local issue, sorry for taking up your time and many thanks for your work and support.

ChristophWurst · 2018-11-30T09:42:41Z

No worries ✌️

artfulrobot · 2018-11-30T13:32:02Z

For the sake of other googlers, it was the Privacy Badger extension that was generating the errors I saw.

xaverfleer · 2019-05-29T09:03:57Z

I think this is still a bug.

While the behavior is correct (JavaScript gets blocked by the addon), the error message is incorrect.
Expected Error Message: none
Actual Error Message: "Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)."

xaverfleer · 2019-05-29T09:04:24Z

For the sake of other googlers, I oberved the same behavior with uMatrix addon.

deoakshay · 2019-09-13T09:55:04Z

I am still getting this error in the console, when trying to login to my gmail account

quenenni · 2019-09-19T15:58:46Z

I discovered that problem with all the v15.0.7 and v15.0.11 instances of NC I recently updated.
They were still working despite all these requests blocked by FF, except few ones that had lots of problems after the update.

Some resources are blocked by CSP in FF, but only in recent versions.
My collegea with v60.x doesn't have the problem, me with v69, I have it (and another collegea too).
No problem in chromium (Version 73.0.3683.75 (Developer Build) built on Debian 9.8, running on Debian 9.11 (64-bit)).

That was not a cache problem, not an add-on in FF, it was linked to the CSP policy returned by Nextcloud.

even in a new FF profile, the problem persisted
restarded nginx / php-fpm; emptied opcache, restarted redis

I fixed the problem by changing the policy header that Nextcloud is generating.
I modified the file lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php (line 407):

$policy = "default-src 'none';";

changed to:

$policy = "default-src 'self' 'unsafe-inline';";

Now everything's good.
But, tbh, I'm not sure if what I did didn't weaken the security too much.

~~I'll let experts judge it.~~

Edit: I was wrong with my solution. Check next post

quenenni · 2019-09-19T18:23:17Z

It seems I was wrong with my solution.
I guess too many tests in lots of directions can do that.

The problematic header comes from the 'useJsNonce' feature.

With it, the "script-src 'nonce-....' header is blocked by the CSP control in FF.

By commenting the block in lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php (line 413 -> 421)

/*          if(is_string($this->useJsNonce)) {
                $policy .= '\'nonce-'.base64_encode($this->useJsNonce).'\'';
                $allowedScriptDomains = array_flip($this->allowedScriptDomains);
                unset($allowedScriptDomains['\'self\'']);
                $this->allowedScriptDomains = array_flip($allowedScriptDomains);
                if(count($allowedScriptDomains) !== 0) {
                    $policy .= ' ';
                }
            }*/

and forcing the 'unsafe-inline' property of script-src by commeting the test on line 425

//          if($this->inlineScriptAllowed) {
                $policy .= ' \'unsafe-inline\'';
//          }

now it works.

kesselb · 2019-09-19T18:38:50Z

@quenenni https://github.com/nextcloud/server/issues/new?labels=bug%2C+0.+Needs+triage&template=Bug_report.md

quenenni · 2019-09-19T19:11:37Z

You're right.
This report was not about CSP but privacy badger.
My mistake. Sorry.

ovk · 2019-10-24T01:58:00Z

@quenenni , did you find a working solution to this issue?

I am getting the same problem on Firefox 69 (script blocked by CSP). Wonder why this issue is closed despite problem not being resolved.

ChristophWurst · 2019-10-24T07:10:47Z

Because it's not a problem of Nextcloud. The extension tries to modify the page in a way that is against the page's security rules.

ainola · 2019-10-31T07:22:13Z

I'm getting hit with this even without any addons. I started a fresh firefox profile and even got CSP errors on the login page

I'm using nginx and a configuration nearly identical to the recommended config from the docs. Nextcloud is version 17 and Firefox version 70.

ovk · 2019-10-31T12:57:26Z

Info for anyone who is still seeing requests blocked by CSP in Firefox (even without any extensions) - this appears to be a bug in Firefox.

Details are here https://bugzilla.mozilla.org/show_bug.cgi?id=1591807

quenenni · 2019-10-31T12:58:21Z

@ovk, did you try my solution ? (modifying the file lib/public/AppFramework/Http/EmptyContentSecurityPolicy.php )

If it's a plugin that generates that error, I don't know which one.
But everytime I tried to update or create a new instance of a Nextcloud (15 & 16), I had that same problem, sometimes with few apps (but always at least the classical apps)

Having so few times at the moment, I didn't check more to see what's causing it.
Hopefully, in a near future.

quenenni · 2019-10-31T13:06:42Z

Info for anyone who is still seeing requests blocked by CSP in Firefox (even without any extensions) - this appears to be a bug in Firefox.

Details are here https://bugzilla.mozilla.org/show_bug.cgi?id=1591807

Nice catch. Hopefully this will be fixed soon.

sebastiansterk · 2019-11-02T08:34:58Z

I have the same issue in Firefox and Chrome. I'm using the Nextcloud Docker Image (latest one and already tried it with v16, same issue)

ovk · 2019-11-02T13:59:10Z

@sebastiansterk this is surprising, as I only observed this bug in the Firefox. I'd suggest you to try the minimal example that I posted in the bug description with FF and Chrome (with no addons), and see if there is any difference.

gnikyt · 2019-11-07T19:16:37Z

@quenenni Tried your solution, although the CSP errors are gone from console, the JS and CSS is not applied to the site at all and page still takes over a minute to load, was that the case for you?

quenenni · 2019-11-08T13:05:24Z

@ohmybrew Sorry but no. I didn't have a slow loading problem.
As soon as I applied the change and reloaded the page, everything was smooth.

What you can do, as the cache system in FF (and other browsers) are becoming a real pain in the a** and when testing something and it often makes impossible to know if the test was really done, is to try your NC without the cache.
Go on the Nc page, open the debugger (F12 by default), go to the network tab and select the option "Deactivate cache".
Keep the debugger open and reload the page to see if there is a difference.

gnikyt · 2019-11-08T13:14:08Z

@quenenni I actually ended up solving my issue. I turned loglevel to 0 in config and noticed during the slow page reload, it was spamming the NextCloud log saying server.scss was locked.

I had file locking on.

So I disabled file locking and memcache in config, refreshed the page and all was normal.

I re-enabled memcache (kept file locking off for now), refreshed, and all still good.

It appears the compiled css and js files got removed somehow, nextcloud tried to remake them but due to the filelock it ran into issues. I can see in the core directory now that all files are there for styling and js.

nextcloud-bot added the bug label Nov 29, 2018

ChristophWurst added needs info 0. Needs triage Pending check for reproducibility or if it fits our roadmap labels Nov 29, 2018

artfulrobot closed this as completed Nov 30, 2018

This was referenced Nov 2, 2019

CSP blocks resources #17783

Closed

Missing some icons when S3 is primary storage #17781

Closed

kesselb mentioned this issue Nov 27, 2019

SVG logo fill color is changed in Firefox #17814

Closed

juliusknorr mentioned this issue Nov 27, 2019

Allow inline styles for theming images #18140

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

CSP blocked loading resource at inline script-src error in Firefox. #12724

CSP blocked loading resource at inline script-src error in Firefox. #12724

artfulrobot commented Nov 29, 2018

nextcloud-bot commented Nov 29, 2018

artfulrobot commented Nov 29, 2018 •

edited

Loading

ChristophWurst commented Nov 29, 2018

artfulrobot commented Nov 30, 2018

ChristophWurst commented Nov 30, 2018

artfulrobot commented Nov 30, 2018

ChristophWurst commented Nov 30, 2018

artfulrobot commented Nov 30, 2018

xaverfleer commented May 29, 2019

xaverfleer commented May 29, 2019 •

edited

Loading

deoakshay commented Sep 13, 2019

quenenni commented Sep 19, 2019 •

edited

Loading

quenenni commented Sep 19, 2019

kesselb commented Sep 19, 2019

quenenni commented Sep 19, 2019

ovk commented Oct 24, 2019

ChristophWurst commented Oct 24, 2019

ainola commented Oct 31, 2019 •

edited

Loading

ovk commented Oct 31, 2019

quenenni commented Oct 31, 2019

quenenni commented Oct 31, 2019

sebastiansterk commented Nov 2, 2019 •

edited

Loading

ovk commented Nov 2, 2019

gnikyt commented Nov 7, 2019

quenenni commented Nov 8, 2019

gnikyt commented Nov 8, 2019

CSP blocked loading resource at inline script-src error in Firefox. #12724

CSP blocked loading resource at inline script-src error in Firefox. #12724

Comments

artfulrobot commented Nov 29, 2018

Steps to reproduce

Expected behaviour

Actual behaviour

Server configuration detail

Client configuration

Logs

nextcloud-bot commented Nov 29, 2018

artfulrobot commented Nov 29, 2018 • edited Loading

ChristophWurst commented Nov 29, 2018

artfulrobot commented Nov 30, 2018

ChristophWurst commented Nov 30, 2018

artfulrobot commented Nov 30, 2018

ChristophWurst commented Nov 30, 2018

artfulrobot commented Nov 30, 2018

xaverfleer commented May 29, 2019

xaverfleer commented May 29, 2019 • edited Loading

deoakshay commented Sep 13, 2019

quenenni commented Sep 19, 2019 • edited Loading

quenenni commented Sep 19, 2019

kesselb commented Sep 19, 2019

quenenni commented Sep 19, 2019

ovk commented Oct 24, 2019

ChristophWurst commented Oct 24, 2019

ainola commented Oct 31, 2019 • edited Loading

ovk commented Oct 31, 2019

quenenni commented Oct 31, 2019

quenenni commented Oct 31, 2019

sebastiansterk commented Nov 2, 2019 • edited Loading

ovk commented Nov 2, 2019

gnikyt commented Nov 7, 2019

quenenni commented Nov 8, 2019

gnikyt commented Nov 8, 2019

artfulrobot commented Nov 29, 2018 •

edited

Loading

xaverfleer commented May 29, 2019 •

edited

Loading

quenenni commented Sep 19, 2019 •

edited

Loading

ainola commented Oct 31, 2019 •

edited

Loading

sebastiansterk commented Nov 2, 2019 •

edited

Loading