Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Nonce is not used in profiler page #44472

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
garak opened this issue Dec 6, 2021 · 2 comments
Closed

Nonce is not used in profiler page #44472

garak opened this issue Dec 6, 2021 · 2 comments

Comments

@garak
Copy link
Contributor

garak commented Dec 6, 2021

Symfony version(s) affected

4.4 5.4 6.0 6.1

Description

My webserver (nginx, but I guess it doesn't matter) is configured with a strict CSP that allows only self and nonces.
All is fine when I browse pages, since the web debug toolbar is correctly rendered with proper nonces.
The problem is when I click on WDT to open the profiler: here the style and the script are blocked.

I see that, actually, the template of profiler is not using nonces at all.

How to reproduce

Use a nginx config like this one:

server {
    server_name foobar.localhost;
    root /myproject/public;
    location / {
        try_files $uri /index.php$is_args$args;
    }
    location ~ ^/index\.php(/|$) {
        fastcgi_pass php:9000;
        fastcgi_split_path_info ^(.+\.php)(/.*)$;
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
        fastcgi_param DOCUMENT_ROOT $realpath_root;
        fastcgi_param HTTP_X_SYMFONYPROFILER_SCRIPT_NONCE $request_id;
        fastcgi_param HTTP_X_SYMFONYPROFILER_STYLE_NONCE $request_id;
    }   
    add_header Content-Security-Policy "default-src 'self'; style-src 'self' 'nonce-$request_id'; script-src 'self' 'nonce-$request_id'";
}

try to access the profiler on /_profiler URL.

Possible Solution

Using the same variables (csp_script_nonce and csp_style_nonce) currently used for WDT.

Additional Context

No response

@derrabus
Copy link
Member

derrabus commented Dec 6, 2021

Do you want to work on a PR?

@fabpot fabpot closed this as completed Feb 25, 2022
fabpot added a commit that referenced this issue Feb 25, 2022
This PR was merged into the 4.4 branch.

Discussion
----------

[WebProfilerBundle] add nonces to profiler

| Q             | A
| ------------- | ---
| Branch?       | 4.4
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #44472
| License       | MIT
| Doc PR        | none

Commits
-------

cbd670f add nonces to profiler
@damienfa
Copy link
Contributor

I noticed the same problem with the {{ dump() }} display.
The HTML code generated is ok, but the <script> are without "nonce" so my browser deny it and the expand/collapse in the sf-dump is not working.
@fabpot , any solution ? 😕

Thanks !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

5 participants