Remove 'unsafe-eval' in CSP guidance

[guardrex]

Fixes #29293

Mackinnon ... I see that Pavel is still working on runtime bits, but it is ok to knock this out for preview coverage now?

It's not easy to see from the diff because it's adding versioned content. The changes here are to ...

• Remove the following line ...

  * Specify `unsafe-eval` to permit the Blazor WebAssembly Mono runtime to function.

• Change part of the WASM policy from ...

  script-src 'self'
             'unsafe-eval';

  ... to ...

  script-src 'self';

---

Internal previews

📄 File	🔗 Preview link
aspnetcore/blazor/security/content-security-policy.md	Enforce a Content Security Policy for ASP.NET Core Blazor

[MackinnonBuck]

@guardrex While 'unsafe-eval' is no longer required, 'wasm-unsafe-eval' is required instead (because WebAssembly execution is disabled without it). See https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src#unsafe_webassembly_execution.

[guardrex]

@MackinnonBuck ... Ok ... I put that on the last commit.

... and then I added that cross-link to it on the next commit.

[damienbod]

@MackinnonBuck unsafe-eval is still required due to the blazor js script. I get errors when I test this with the latest preview

Did I miss something?

.NET 7 it's not working
https://github.com/damienbod/BlazorNet7

.NET 8 it's not working

https://github.com/damienbod/Hostedblazor8Aad

builder.AddScriptSrc()
	.Self()
	.WithHash256("v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA=")
	//.WasmUnsafeEval(); cannot use in .NET 8 preview, .NET 7
	.UnsafeEval(); 

Greetings Damien

[guardrex]

@damienbod ... I recommend posting the rendered meta tags built by Lock's API and to show the errors.

[guardrex]

The script hash is probably different. Try that hash from the error and see if it resolves it ...

- .WithHash256("v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA=")
+ .WithHash256("sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=")

(Nevemind ... I remember now that yes, the sha256- is part of the hash string.

Either that, or add the hash because this is a different script ...

+ .WithHash256("sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=")

[damienbod]

CSP response headers:

Working:

object-src 'none'; block-all-mixed-content; img-src 'self' data:; form-action 'self' https://login.microsoftonline.com/; font-src 'self'; style-src 'self'; base-uri 'self'; frame-ancestors 'none'; script-src 'self' 'sha256-v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA=' 'unsafe-eval'

Not Working:

object-src 'none'; block-all-mixed-content; img-src 'self' data:; form-action 'self' https://login.microsoftonline.com/; font-src 'self'; style-src 'self'; base-uri 'self'; frame-ancestors 'none'; script-src 'self' 'sha256-v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA=' 'wasm-unsafe-eval'

Error:

blazor.webassembly.js:1 EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'sha256-v8v3RKRPmN4odZ1CWM5gw80QKPCCWMcpNeOmimNL2AA=' 'wasm-unsafe-eval'".

    at Function (<anonymous>)
    at dotnet.8.0.0-preview.3.23174.8.b7g991eq1o.js:3:165575
    at sc (dotnet.8.0.0-preview.3.23174.8.b7g991eq1o.js:3:165596)
    at dotnet.8.0.0-preview.3.23174.8.b7g991eq1o.js:3:168598
    at ic (dotnet.8.0.0-preview.3.23174.8.b7g991eq1o.js:3:169205)
    at dotnet.8.0.0-preview.3.23174.8.b7g991eq1o.js:3:164662
    at Object.ec [as call_assembly_entry_point] (dotnet.8.0.0-preview.3.23174.8.b7g991eq1o.js:3:165046)
    at Object.callEntryPoint (blazor.webassembly.js:1:42926)
    at qt (blazor.webassembly.js:1:59086)

[guardrex]

When we used to have hashes in the topic (6.0 or earlier), I would update them on release day because they were potentially being churned by the PU all the way up to final release. That wasn't a problem at 7.0 because no hashes were required for the CSP in the base OOB app case.

[damienbod]

@guardrex The one which fails uses the 'wasm-unsafe-eval' and the error is about the missing 'unsafe-eval'

Maybe this is something new in the .NET 8 Blazor js?

[guardrex]

the error is about the missing 'unsafe-eval'

... but perhaps that's only because it needs the hash for the script that the error mentions.

What happens if you use the one from the error message ...

builder.AddScriptSrc()
       .Self()
       .WithHash256("sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=")
       .WasmUnsafeEval();

[guardrex]

... and btw ... looks like you aren't on latest ...

preview.3

Update to Pre4. It might not matter, but there's a lot of churn on a lot of features preview-to-preview 🏃⛏️ 🏃⛏️🏃⛏️.

[damienbod]

@guardrex latest version does not start

dotnet/aspnetcore#48298

yes, this is probably just a WIP problem and will probably be fixed in the next preview release. I just wanted to mention it so that it's visible. Released version works without problem. I will test with the other hash as well.

Greetings Damien

[damienbod]

Was doing some testing again and this does not work in .NET 7 either, the 'unsafe-eval' is still required (The headers were disabled when I tested this before)

.NET 7 error:

blazor.webassembly.js:1 EvalError: Refused to evaluate a string as JavaScript because 'unsafe-eval' is not an allowed source of script in the following Content Security Policy directive: "script-src 'self' 'sha256-ZD0chCyBaNHl+4UwQHJIHGoYhKwMeyCXGgJTKW5/67E=' 'wasm-unsafe-eval'".

    at Function (<anonymous>)
    at Fi (dotnet.7.0.5.fo1zsa9mkw.js:5:72686)
    at Wi (dotnet.7.0.5.fo1zsa9mkw.js:5:72322)
    at zi (dotnet.7.0.5.fo1zsa9mkw.js:5:76301)
    at Li (dotnet.7.0.5.fo1zsa9mkw.js:5:77119)
    at Qi (dotnet.7.0.5.fo1zsa9mkw.js:5:82274)
    at Ki (dotnet.7.0.5.fo1zsa9mkw.js:5:83228)
    at Tc (dotnet.7.0.5.fo1zsa9mkw.js:5:101569)
    at Object.kc [as mono_wasm_load_runtime] (dotnet.7.0.5.fo1zsa9mkw.js:5:101274)
    at postRun (blazor.webassembly.js:1:44107)

[MackinnonBuck]

@damienbod The 'unsafe-eval' requirement will still be required for .NET 7 and earlier. Also, please note that the updates enabling improved CSP compliance aren't available in a public preview release yet. You could try installing a nightly build from https://github.com/dotnet/installer to test this new improvement. Thanks!