5

i'am wondering about the quote from the specification: (https://dvcs.w3.org/hg/content-security-policy/raw-file/tip/csp-specification.dev.html)

To reap the greatest benefit, authors will need to move all inline script and style out-of-line, for example into external scripts, because the user agent cannot determine whether an inline script was injected by an attacker.

Sourcing out all inline-script is a time heavy task.

My question is from the security point of view. Do you really get any security benefit by extracting all inline-script (e.g. JavaScript) to external sources?

Thank you

blahdiblah
  • 33,069
  • 21
  • 98
  • 152
user2239197
  • 53
  • 1
  • 4
  • Just a heads up, CSP 1.1 plans to provide functionality that will allow you to whitelist individual script blocks. (via script-nonce or script-hash). This is still a ways out and removing the inline script is still your most foolproof route. – oreoshake Apr 03 '13 at 18:54

1 Answers1

6

The key part is

the user agent cannot determine whether an inline script was injected by an attacker.

To provide protection, CSP has to prevent substrings controlled by an attacker from causing code to run. Since the user agent does not know which parts of the HTML were specified by untrusted inputs, and which come from a template written by a trusted developer, it has to assume the worst -- that any attribute or element could be controlled by an attacker.

Do you really get any security benefit by extracting all inline-script (e.g. JavaScript) to external sources?

No. Extracting the scripts that you want to run does not provide any security benefit, it merely lets you run the scripts that you want while still using CSP.

The security benefit comes from being able to invoke the browser's HTML parser without unintentionally executing scripts that abuse domain privileges or steal secrets.

Mike Samuel
  • 118,113
  • 30
  • 216
  • 245
  • Removing all inline script does guarantee you'll never put dynamic content in a script tag (which usually leads to undesirable behavior). . Whether that's a security benefit is pretty controversial :) – oreoshake Apr 03 '13 at 18:52
  • @oreoshake, Agree re "removing all inline script" in general but not when used with a content security police where `policy.allowsInlineScript` is falsey which is what the OP implied. – Mike Samuel Apr 03 '13 at 20:53