11

Has anyone found a way to integrate the data:image/png as csp_whitelist?

[Report Only] Refused to load the image 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR4nGP6zwAAAgcBApocMXEAAAAASUVORK5CYII=' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com *.cloudflare.com https://cdn.klarna.com *.paypal.com https://s.ytimg.com *.usercentrics.eu 'self' 'unsafe-inline'".

Improve this question
3

3 Answers 3

Reset to default
15

In your custom csp_whitelist.xml (eg. in a custom modules etc-directory) add this:

<policy id="img-src">
  <values>
    <value id="data" type="host">data:</value>
  </values>
</policy>

The colon as suffix is the important stuff here.

Improve this answer
5
  • it fix issue but it looks like dirty workaround. Hm
    – Konrad Siamro
    May 5, 2020 at 10:10
  • thanks, this will work
    – Materix
    May 5, 2020 at 10:38
  • @KonradSiamro AFAIK the data: should be declared as scheme and not as host in the CSP regarding the CSP-specification, but the Magento-CSP-Module only supports host and hash as type - no support for real scheme-policies right now.
    – Tobias Wassermann
    May 5, 2020 at 11:15
  • ok, thanks for explanation
    – Konrad Siamro
    May 5, 2020 at 11:35
  • @Tobias Wassermann, I have been trying to fix the similar issue post upgrade to 2.3.5. Could you please look at my post and suggest a possible solution magento.stackexchange.com/questions/314451/…
    – CodeForGood
    Jun 8, 2020 at 4:32
0

You can add a domain to the whitelist for a policy (like script-src, style-src, font-src and others) by adding a csp_whitelist.xml to your custom module’s etc folder.

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="devdocs-base" type="host">https://devdocs.magento.com</value>
                <value id="magento" type="host">https://magento.com</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="devdocs" type="host">https://devdocs.magento.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

From: https://devdocs.magento.com/guides/v2.3/extension-dev-guide/security/content-security-policies.html

Related: Magento 2.3.5 Content Security Policy false positive cdn fonts

Improve this answer
13
  • Thanks for your answer, in this case I'm mainly interested in the images/fonts/scripts with data:image/png;base64, data:application/javascript;base64, data:application/font-woff;base64
    – Materix
    May 1, 2020 at 12:24
  • Do you need clear cache or something after doing this? It doesn't work for me
    – KaMZaTa
    May 1, 2020 at 12:50
  • @KaMZaTa magento.stackexchange.com/questions/311661/…
    – Materix
    May 1, 2020 at 13:16
  • It doesn't work for me. Did it work for you? I'm trying to whitelisting a script added in <head> through layout/default.xml file and placed in my_theme/web/js/myscript.js. It load the script but it is not whitelisted.
    – KaMZaTa
    May 1, 2020 at 13:35
  • 4
    @CodeForGood just disable the module: magento module:disable Magento_Csp
    – KaMZaTa
    Jun 11, 2020 at 12:55
0

If the above solution will not work then try the below one.

<policy id="img-src">
  <values>
    <value id="data-image" type="host">'self' data:</value>
  </values>
</policy>

It is working in the Magento2.4.2 commerce version.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.