如何修復(fù) CSP 錯(cuò)誤？ '拒絕執(zhí)行內(nèi)聯(lián)事件處理程序，因?yàn)樗`反了以下內(nèi)容安全策略指令...”
P粉781235689
2023-08-30 11:44:31
<p>我在 script-src 中添加隨機(jī)數(shù)值時(shí)收到 CSP 錯(cuò)誤。
這是我正在設(shè)置的 CSP -
內(nèi)容安全策略：默認(rèn) src '無'； script-src 'self' '不安全評(píng)估' 'nonce-b1967a39a02f45edbac95cbb4651bd12' '不安全哈希'; frame-src 'self' 'nonce-b1967a39a02f45edbac95cbb4651bd12' '不安全哈希';連接-src'自我'； img-src“自身”數(shù)據(jù)：； style-src 'self' '不安全內(nèi)聯(lián)';對(duì)象-src'自我'； font-src'自身'數(shù)據(jù)：;</code></p>
<p>我的JS文件內(nèi)容是-</p>
<pre class="brush:php;toolbar:false;"><html dir="ltr">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<title> WebHelp Navigation Toolbar </title>
<style>
<!--
body {margin:0;}
-->
</style>
<script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whver.js" charset="utf-8"></script>
<script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whutils.js" charset="utf-8"></script>
<script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whmsg.js" charset="utf-8"></script>
<script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whproxy.js" charset="utf-8"></script>
<script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whmozemu.js" charset="utf-8"></script>
<script nonce='b1967a39a02f45edbac95cbb4651bd12' src="whtbar.js" charset="utf-8"></script>
<script nonce='b1967a39a02f45edbac95cbb4651bd12' type="text/javascript" language="JavaScript1.2">
//<![CDATA[
function printTopic() {
var topicPane;
if (top.frames[0].name == "ContentFrame")
topicPane = top.frames[0].frames[1].frames[1];
else
topicPane = top.frames[1].frames[1];
topicPane.focus();
var msg = new whMessage(WH_MSG_PRINT, 0, 0);
notify(msg);
}
//]]>
</script>
</head>
<body marginheight="0" marginwidth="0" bgcolor="#363f48" background="background.png" scroll="no">
<script nonce='b1967a39a02f45edbac95cbb4651bd12' language="javascript1.2">
<!--
if (window.gbWhTBar)
{
setButtonFont("toc","Arial","11pt","#a7abaf","Normal","Normal","none");
setButtonFont("toc","Arial","11pt","White","Normal","Normal","none", true);
setButtonFont("idx","Arial","11pt","#a7abaf","Normal","Normal","none");
setButtonFont("idx","Arial","11pt","White","Normal","Normal","none", true);
setButtonFont("fts","Arial","11pt","#a7abaf","Normal","Normal","none");
setButtonFont("fts","Arial","11pt","White","Normal","Normal","none", true);
setButtonFont("glo","Arial","11pt","#a7abaf","Normal","Normal","none");
setButtonFont("glo","Arial","11pt","White","Normal","Normal","none", true);
setButtonFont("searchform","Arial","11pt","#a7abaf","Normal","Normal","none");
setButtonFont("searchform","","","","","","", true);
setButtonFont("banner","","","","","","");
setButtonFont("banner","","","","","","", true);
setButtonFont("custom15160","Arial","11pt","#a7abaf","Normal","Normal","none");
setButtonFont("custom15160","Arial","11pt","White","Normal","Normal","none", true);
gsIToc = "wht_toc_n.gif";
gsITocS = "wht_toc_h.gif";
gsIIndex = "wht_idx_n.gif";
gsIIndexS = "wht_idx_h.gif";
gsISearch = "wht_fts_n.gif";
gsISearchS = "wht_fts_h.gif";
gsIGlossary = "wht_glo_n.gif";
gsIGlossaryS = "wht_glo_h.gif";
gsIWebSearch = "wht_ws.gif";
gsIWebSearchD = "wht_ws_g.gif";
gsIBanner = "wht_logo1.gif";
gsIGo = "wht_go.gif";
setBackgroundcolor("#363f48");
setBackground("background.png");
setAlignment("left");
setGoImage("search-input-go.png");
if (!gsBgImage)
{
setButtonBgColor("toc", gsBgColor);
setButtonBgColor("idx", gsBgColor);
setButtonBgColor("fts", gsBgColor);
setButtonBgColor("glo", gsBgColor);
setButtonBgColor("toc", gsTBSelectedBgColor, true);
setButtonBgColor("idx", gsTBSelectedBgColor, true);
setButtonBgColor("fts", gsTBSelectedBgColor, true);
setButtonBgColor("glo", gsTBSelectedBgColor, true);
setButtonBgColor("toc","#363f48");
setButtonBgColor("idx","#363f48");
setButtonBgColor("fts","#363f48");
setButtonBgColor("glo","#363f48");
setButtonBgColor("searchform","");
setButtonBgColor("banner","");
setButtonBgColor("custom15160","#363f48");
}
setButtonBgColor("toc","#363f48", true);
setButtonBgColor("idx","#363f48", true);
setButtonBgColor("fts","#363f48", true);
setButtonBgColor("glo","#363f48", true);
setButtonBgColor("searchform","", true);
setButtonBgColor("banner","", true);
setButtonBgColor("custom15160","#363f48", true);
addButton("toc",BTN_TEXT|BTN_IMG,"Contents","","","","",0,0,"contents-unselected.png","contents-selected.png","","contents-selected.png","","");
addButton("fts",BTN_TEXT|BTN_IMG,"Search","","","","",0,0,"search-unselected.png","search-selected.png","","search-selected.png","","");
addButton("searchform",BTN_TEXT,"","","","","",0,0,"","","","","","");
addButton("custom15160",BTN_TEXT|BTN_IMG,"Print","","printTopic();","","",0,0,"print-unselected.png","print-selected.png","","print-selected.png","","");
addButton("blankblock");
writeStyle(false);
ReSortToolbarButtons();
}
else
document.location.reload();
//-->
</script>
</body></pre>
<p>從 script-src 中刪除“unsafe-inline”并添加“nonce-b1967a39a02f45edbac95cbb4651bd12”后，我收到此錯(cuò)誤。在這個(gè)問題上糾結(jié)了好久。需要一些指導(dǎo)。提前致謝。</p>
錯(cuò)誤訊息表示您有一個(gè)內(nèi)嵌事件處理程序，這表示您在某處有一個(gè) onclick、onblur、onchange 等屬性。錯(cuò)誤訊息可能包含指向?qū)嶋H程式碼的連結(jié)。
要允許內(nèi)聯(lián)事件處理程序，您需要使用其中一個(gè)
- “unsafe-hashes”和程式碼的雜湊
- '不安全內(nèi)聯(lián)'
但是，如果您能夠重寫程式碼，最好的選擇是使用事件偵聽器。
屬性不是 nonceable，因此您的 nonce 方法不適用於這段程式碼。
點(diǎn)贊 +0
P粉781235689
1
0
0
