19

Lately, some websites such as Facebook use the Content Security Policy (CSP) to restrict loading of scripts from "untrusted sources". For example, when requesting Facebook HTML content (e.g. https://www.facebook.com ), Facebook's HTTP response includes the following response header: 

x-webkit-csp:default-src *;script-src https://*.facebook.com http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl 'unsafe-inline' 'unsafe-eval' https://*.akamaihd.net http://*.akamaihd.net;style-src * 'unsafe-inline';connect-src https://*.facebook.com http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.spotilocal.com:* https://*.akamaihd.net ws://*.facebook.com:* http://*.akamaihd.net;

This has impact on some bookmarklets which require to load and execute Javascript libraries from untrusted sources.

For example, whenever I try to run the Show Anchors bookmarklet on a Facebook page, execution of this bookmarklet fails as it tries to load jQuery from an untrusted source. In Chrome's Developer console, it will say:

Refused to load the script 'http://ajax.googleapis.com/ajax/libs/jquery/1.3/jquery.min.js' because it violates the following Content Security Policy directive: "script-src https://*.facebook.com http://*.facebook.com https://*.fbcdn.net http://*.fbcdn.net *.facebook.net *.google-analytics.com *.virtualearth.net *.google.com 127.0.0.1:* *.spotilocal.com:* chrome-extension://lifbcibllhkdhoafpjfnlhfpfgnpldfl 'unsafe-inline' 'unsafe-eval' https://*.akamaihd.net http://*.akamaihd.net".

I've found a Chrome documentation page about this topic, but it only applies to Chrome extensions.

I'm looking for solutions that allow me to

  • either for a single time deactivate CSP
  • or permanently whitelist my trusted sources.
Improve this question
3
  • This might be helpful.
    – Rudie
    Commented Oct 25, 2014 at 16:21
  • @Rudie Will that work for Chrome Mobile?
    – Michael
    Commented Dec 30, 2014 at 23:31
  • @Michael If Chrome Mobile supports modern-ish extensions. The WeRequest is kind of new. I don't use Chrome Mobile, so I've no idea.
    – Rudie
    Commented Dec 31, 2014 at 0:10

2 Answers 2

Reset to default
2

Methods Endorsed by Chrome Apps

Use templating libraries

Use a library that offers precompiled templates and you’re all set. You can still use a library that doesn’t offer precompilation, but it will require some work on your part and there are restrictions.

You will need to use sandboxing to isolate any content that you want to do ‘eval’ things to. Sandboxing lifts CSP on the content that you specify.

Sandbox local content

Sandboxing allows specified pages to be served in a sandboxed, unique origin. These pages are then exempt from their Content Security Policy. Sandboxed pages can use iframes, inline scripting, and eval() (and the last two are the ones being prevented). That'll fix 'unsafe-inline' and 'unsafe-eval'.

  • Use inline scripts in sandbox
  • Include sandbox in manifest

Access remote resources

You can fetch remote resources via XMLHttpRequest and serve them via blob:, data:, or filesystem: URLs. This should fix the jQuery fetching issue.

Manifest requirement

To be able to do cross-origin XMLHttpRequests, you'll need to add a permission for the remote URL's host.

Cross-origin XMLHttpRequest

Fetch the remote URL into the app and serve its contents as a blob: URL.

I don't think you can do any of these. To fix the unsafe-eval and unsafe-inline response headers, only the script owner can fix the code or if it's in public domain, you can fix it. All this is probably a one-time fix.

Hacks

UnsafeWindow

http://wiki.greasespot.net/UnsafeWindow

Content Script Injection

http://wiki.greasespot.net/Content_Script_Injection

The hacks however have downsides because they've known to cause security holes atleast the first one, definitely.

Improve this answer
-2

You can edit these settings in the content tab, which you can access directly by typing chrome://settings/content in the address bar. You can whitelist specific domains on specific content types.

Improve this answer
1
  • 12
    Where exactly in content settings do I do this, and how? I tried adding my site to the "cookie and site data exceptions" to no effect. None of the other settings seem relevant.
    – Michael
    Commented Mar 21, 2015 at 20:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .