content-security-policy

Cordova - refuse to execute inline event handler because it violates the following content Security policy

由 ↘锁芯ラ 提交于 2019-11-27 13:04:47
I'm training for Cordova application development and I turn around a problem with Content Security Policy. My application is running with the Android emulator, but when I have to execute a javascript I get a message in NetBeans (output window). Refused to execute inline event handler because it violates the following Content Security Policy directive: "script-src 'self' https://ssl.gstatic.com". (22:35:56:126 | error, security) at www/index.html:58 My code is below. This is my index.html. I try to understand how CSP works and I think I understand the concept, but in this case, I don't

Cordova Content Security Policy

由 谁说胖子不能爱 提交于 2019-11-27 13:04:00
问题 I have a Cordova app and after upgrading (5.0.0) it I'm unable to call any resource at all. I've added the whitelist plugin and added the following tag to index.html <meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval' *.azure-mobile.net localhost:1337 *.ajax.aspnetcdn.com"> I got the following errors: Refused to load the script 'http://ajax.aspnetcdn.com/ajax/mobileservices/MobileServices.Web-1.2

Content Security Policy: cannot load Google API in Chrome extension

由 雨燕双飞 提交于 2019-11-27 11:43:42
问题 This is relative an Chrome extension. I am trying a simple one which uses the Google Chart API I have this code in my html document "popup.html", which is loaded on the click on the Icon. <!doctype html> <html> <head> <script type="text/javascript" src="js/libs/jquery-1.8.0.min.js"></script> <script type="text/javascript" src="js/popup.js"></script> <script type="text/javascript" src="http://www.google.com/jsapi?key=xxxxxxxxxxx"></script> [...] </body> </html> I get the following message:

What’s the purpose of the HTML “nonce” attribute for script and style elements?

由 六月ゝ 毕业季﹏ 提交于 2019-11-27 10:31:13
W3C says there is a new attribute in HTML5.1 called nonce for style and script that can be used by the Content Security Policy of a website. I googled about it but finally didn't get it what actually this attribute do and what changes when using it? The nonce attribute enables you to “whitelist” certain inline script and style elements, while avoiding use of the CSP unsafe-inline directive (which would allow all inline script / style ), so that you still retain the key CSP feature of disallowing inline script / style in general. So the nonce attribute is way of telling browsers that the inline

Violating Content Security Policy directive after ember-cli 0.0.47 upgrade

由 有些话、适合烂在心里 提交于 2019-11-27 09:45:54
问题 I upgraded my ember-cli app to 0.0.47 and am now getting a bunch of errors in my browser console related to the content security policy. How do I fix this issue? Refused to load the script 'http://use.typekit.net/abcdef.js' because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' localhost:35729". login:1 Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'unsafe-eval' localhost

Simple jQuery within <script> tag in Chrome extension popup is not executing

由 可紊 提交于 2019-11-27 09:38:45
This is my HTML: <!doctype html> <html> <head> <title>PassVault</title> <link rel="stylesheet" type="text/css" href="stil.css"> <meta charset="utf-8"> <script type='text/javascript' src='http://ajax.googleapis.com/ajax/libs/jquery/1.6.4/jquery.min.js'></script> <script type="text/javascript"> $(document).ready(function () { $("div").css("border", "3px solid red"); }); </script> </head> <body> <div id="rainbow"> </div> <div id="loginBox"> <div id="welcome"> Dobrodošli, uporabnik! </div><br> </div> </body> </html> After the document loads up, it's supposed to put a red border around all my divs

How to override content security policy while including script in browser JS console?

由 こ雲淡風輕ζ 提交于 2019-11-27 07:12:26
I was trying to include JQuery on an existing website using console this way: var script = document.createElement('script'); script.src = 'http://code.jquery.com/jquery-1.11.1.min.js'; script.type = 'text/javascript'; document.getElementsByTagName('head')[0].appendChild(script); Then I got this error: Content Security Policy: The page's settings blocked the loading of a resource at http://code.jquery.com/jquery-1.11.1.min.js .. During development I might want to include external Javascript. I might not want to copy paste the entire JQuery code since it does not look neat. How to override the

Content Security Policy “data” not working for base64 Images in Chrome 28

由 时光怂恿深爱的人放手 提交于 2019-11-27 07:01:48
In this simple example, I'm trying to set a CSP header with the meta http-equiv header. I included a base64 image and I'm trying to make Chrome load the image. I thought the data keyword should do that, but somehow it's not working. I just get the following error in Developer Tools: Refused to load the image 'data:image/png;base64,R0lGODlhDwAPAOZEAMkJCfAwMMYGBtZMTP75+euIiPFBP+hVVf3v7…nw7yk4Mjr6GLUY+joiBI2QAACABwJDCHgoKOHEoAYVBAgY8GGAxAoNGAmiwMHBCgccKDAKBAA7' because it violates the following Content Security Policy directive: "img-src 'self' data". The example code (JSFiddle is not working for

Chrome 18+: How to allow inline scripting with a Content Security Policy?

由 删除回忆录丶 提交于 2019-11-27 06:58:55
Chrome 18 Dev/Canary has just been released, and content_security_policy will be needed in the manifest for certain extensions. I'm trying to get a CSP working for inline scripting, but I don't know if I'm doing something wrong or if this is a Chrome 18 bug. manifest.json: { "name": "CSP Test", "version": "1.0", "manifest_version": 2, "options_page": "test.html", "content_security_policy": "default-src 'unsafe-inline'" } test.html: <html><head> <script type="text/javascript"> alert("hello"); </script> </head></html> In Chrome 18, this unpacked extension fails to load, displaying an error: If I

Extension refuses to load the script due to Content Security Policy directive

由 こ雲淡風輕ζ 提交于 2019-11-27 06:52:34
Following is my code of HTML Scripts: <script src="http://ajax.googleapis.com/ajax/libs/jquery/1.11.1/jquery.min.js"></script> <script src="background.js"></script> HTML: <button name="btnlogin" id="btnlogin">Login</button><br/><br/> and following is js $(document).ready(function(){ document.getElementById("#btnlogin").click(function(){ alert("s"); }); }); manifest file: { "manifest_version": 2, "name": "One-click Kittens", "description": "This extension demonstrates a 'browser action' with kittens.", "version": "1.0", "browser_action": { "default_icon": "icon.png", "default_popup": "popup
订阅 content-security-policy