Why is inline script forbidden (Content Security Policy)?

Question

i'am wondering about the quote from the specification: (https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html)

To reap the greatest benefit, authors will need to move all inline script and style out-of-line, for example into external scripts, because the user agent cannot determine whether an inline script was injected by an attacker.

Sourcing out all inline-script is a time heavy task.

My question is from the security point of view. Do you really get any security benefit by extracting all inline-script (e.g. JavaScript) to external sources?

Thank you

Just a heads up, CSP 1.1 plans to provide functionality that will allow you to whitelist individual script blocks. (via script-nonce or script-hash). This is still a ways out and removing the inline script is still your most foolproof route. — oreoshake
– oreoshake, Commented Apr 3, 2013 at 18:54

Mike Samuel · Accepted Answer · 2013-04-03 07:23:34Z

7

The key part is

the user agent cannot determine whether an inline script was injected by an attacker.

To provide protection, CSP has to prevent substrings controlled by an attacker from causing code to run. Since the user agent does not know which parts of the HTML were specified by untrusted inputs, and which come from a template written by a trusted developer, it has to assume the worst -- that any attribute or element could be controlled by an attacker.

Do you really get any security benefit by extracting all inline-script (e.g. JavaScript) to external sources?

No. Extracting the scripts that you want to run does not provide any security benefit, it merely lets you run the scripts that you want while still using CSP.

The security benefit comes from being able to invoke the browser's HTML parser without unintentionally executing scripts that abuse domain privileges or steal secrets.

edited Apr 3, 2013 at 7:23

answered Apr 3, 2013 at 7:09

Mike Samuel

121k30 gold badges230 silver badges255 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

oreoshake Over a year ago

Removing all inline script does guarantee you'll never put dynamic content in a script tag (which usually leads to undesirable behavior). <script>var thing = <%= @thing.to_json %>;</script>. Whether that's a security benefit is pretty controversial :)

Mike Samuel Over a year ago

@oreoshake, Agree re "removing all inline script" in general but not when used with a content security police where policy.allowsInlineScript is falsey which is what the OP implied.

Collectives™ on Stack Overflow

Why is inline script forbidden (Content Security Policy)?

1 Answer 1

2 Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related