问题描述
在我的网站上实现 CSP 标头时,我遇到了 webforms 添加到页面的自动生成的回发 JavaScript 的问题:
While implementing the CSP header on my website, I am facing problems with the automatically generated postback JavaScript that webforms adds to the page:
<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['form1'];
if (!theForm) {
theForm = document.form1;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>
为了支持其他一些内联脚本标签,我已经成功添加了 nonce
属性;但是我找不到修改这段生成的代码来做同样的事情的方法.我已经探索了 ClientScript.GetPostBackEventReference
,但这似乎控制了其中的 JavaScript,与 标签本身的呈现无关.
To support some other inline script tags I have successfully added the nonce
attribute; however I can find no way to modify this piece of generated code to do the same thing. I have explored ClientScript.GetPostBackEventReference
, but this appears to control the JavaScript within, nothing about the rendering of the <script>
tag itself.
解决方案不一定需要涉及添加 nonce
属性——任何符合的都可以.例如,如果有一个 ASP.NET 设置可以配置为将此脚本作为文件加载(我可以将其列入白名单),那就没问题了.
The solution does not necessarily need to involve adding the nonce
attribute—anything that complies will do. For example, if there is an ASP.NET setting which can be configured to load this script as a file (which I can whitelist), that would be fine.
推荐答案
祝你好运在 ASP.NET 上使用 Webforms Scheme 实现一个好的 CSP - WebForms 控件将添加一大堆内联脚本,比如这个登录按钮:
Good luck implementing a good CSP on ASP.NET with Webforms Scheme - WebForms controls will add a whole bunch of inline scripts like on this login button:
<a id="btnLogin" class="btn btn-info pull-right" href="javascript:__doPostBack('btnLogin','')">Login</a>
如果你没有使用很多 <asp:...
控件,你可能没问题.
If you're not using many <asp:...
controls, you might be alright.
要允许上面你想运行的脚本,你可以在script-src
之后添加这个到你的CSP:
To allow the above script you want to run, you can add this to your CSP after script-src
:
sha256-uVkxb0ccirYwSBxwdr2/4qtJEH1eBw7MslAgyLdAVVY="
它让您的浏览器知道它应该执行任何具有 sha256 哈希值的脚本.
It lets your browser know that it should execute any script that has that sha256 hash.
如果您使用的换行符与我使用的不同(我认为这是 Windows 风格),我给您的哈希可能不起作用.
The hash I've given you may not work if you're using different newlines to what I'm using (which I believe is windows style).
您还应该注意,如果您没有将默认表单 ID 更改为form1"以外的其他内容的页面.
You should also be careful that if you don't have a page which changes the default form id to something other than "form1".
这篇关于将 nonce 属性添加到自动生成的 WebForms 脚本的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持编程学习网!