mirror of
https://github.com/Drop-OSS/drop.git
synced 2026-07-25 04:15:36 -04:00
[GH-ISSUE #92] CSP violation in production build #50
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @utlilb on GitHub (Jun 6, 2025).
Original GitHub issue: https://github.com/Drop-OSS/drop/issues/92
The images are not loading for the language selection menu. This is due to CSP.
The Content Security Policy (CSP) prevents the evaluation of arbitrary strings as JavaScript to make it more difficult for an attacker to inject unathorized code on your site.
To solve this issue, avoid using eval(), new Function(), setTimeout([string], ...) and setInterval([string], ...) for evaluating strings.
If you absolutely must: you can enable string evaluation by adding unsafe-eval as an allowed source in a script-src directive.
Allowing string evaluation comes at the risk of inline script injection.
1 directive
Source location Directive Status
BU2z-LQD.js:69 script-src blocked
@Huskydog9988 commented on GitHub (Jun 6, 2025):
Can you send the content of
/api/v1, and can you elaborate more on your setup? Do you use a reverse proxy, and if so, do you set a custom CSP? I just did a quick production test on my machine and I don't get a CSP violation.@utlilb commented on GitHub (Jun 6, 2025):
I do have my instance behind nginx. But I haven't done any custom changes to CSP. Just default.
{"appName":"Drop","version":"v0.3.0-nightly.2025.06.06","ref":"c300581"}
@utlilb commented on GitHub (Jun 6, 2025):
Don't know if you'll need this or not but it might help.
curl -I https://games.example.com
HTTP/2 200
server: nginx
date: Fri, 06 Jun 2025 21:48:32 GMT
content-type: text/html;charset=utf-8
referrer-policy: no-referrer
x-content-type-options: nosniff
x-download-options: noopen
x-frame-options: SAMEORIGIN
x-permitted-cross-domain-policies: none
x-xss-protection: 0
access-control-allow-origin: *
set-cookie: drop_i18n_redirected=en-us; Path=/; Expires=Sat, 06 Jun 2026 21:48:32 GMT; SameSite=Lax
cross-origin-resource-policy: same-origin
cross-origin-opener-policy: same-origin
cross-origin-embedder-policy: credentialless
content-security-policy: base-uri 'none'; font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self'; img-src 'self' data: https://www.giantbomb.com https://images.pcgamingwiki.com https://images.igdb.com; object-src 'none'; script-src-attr 'none'; style-src 'self' https: 'unsafe-inline'; script-src 'self' https: 'unsafe-inline' 'strict-dynamic' 'nonce-N6HNvNUcZd3pm/nbJDejg942';
origin-agent-cluster: ?1
x-dns-prefetch-control: off
permissions-policy: camera=(), display-capture=(), fullscreen=(), geolocation=(), microphone=()
cache-control: no-transform
content-security-policy: upgrade-insecure-requests; frame-ancestors 'self' example.com *.example.com
permissions-policy: interest-cohort=()
referrer-policy: same-origin
x-content-type-options: nosniff
x-frame-options: SAMEORIGIN
x-ua-compatible: IE=Edge
x-xss-protection: 1; mode=block
@Huskydog9988 commented on GitHub (Jun 6, 2025):
So at this point I think I can confirm that the emojis aren't causing the CSP violation, see #94, but I am curious what is. Could you send the js file causing the CSP violation either here or in the drop discord?
@Huskydog9988 commented on GitHub (Jun 8, 2025):
Can you pull the latest nightly image and report back if the csp violation continues?
@utlilb commented on GitHub (Jun 8, 2025):
No CSP violation now. Not sure if it was fixed when moving the language selector to the footer or not.
CSP violation in production buildto [GH-ISSUE #92] CSP violation in production build