12

Has anyone found a way to integrate the data:image/png as csp_whitelist?

[Report Only] Refused to load the image 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR4nGP6zwAAAgcBApocMXEAAAAASUVORK5CYII=' because it violates the following Content Security Policy directive: "img-src widgets.magentocommerce.com www.googleadservices.com www.google-analytics.com t.paypal.com www.paypal.com www.paypalobjects.com fpdbs.paypal.com fpdbs.sandbox.paypal.com *.vimeocdn.com s.ytimg.com *.cloudflare.com https://cdn.klarna.com *.paypal.com https://s.ytimg.com *.usercentrics.eu 'self' 'unsafe-inline'".

3

3 Answers 3

15

In your custom csp_whitelist.xml (eg. in a custom modules etc-directory) add this:

<policy id="img-src">
  <values>
    <value id="data" type="host">data:</value>
  </values>
</policy>

The colon as suffix is the important stuff here.

5
  • it fix issue but it looks like dirty workaround. Hm Commented May 5, 2020 at 10:10
  • thanks, this will work
    – Materix
    Commented May 5, 2020 at 10:38
  • @KonradSiamro AFAIK the data: should be declared as scheme and not as host in the CSP regarding the CSP-specification, but the Magento-CSP-Module only supports host and hash as type - no support for real scheme-policies right now. Commented May 5, 2020 at 11:15
  • ok, thanks for explanation Commented May 5, 2020 at 11:35
  • @Tobias Wassermann, I have been trying to fix the similar issue post upgrade to 2.3.5. Could you please look at my post and suggest a possible solution magento.stackexchange.com/questions/314451/… Commented Jun 8, 2020 at 4:32
0

You can add a domain to the whitelist for a policy (like script-src, style-src, font-src and others) by adding a csp_whitelist.xml to your custom module’s etc folder.

<?xml version="1.0"?>
<csp_whitelist xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:module:Magento_Csp/etc/csp_whitelist.xsd">
    <policies>
        <policy id="script-src">
            <values>
                <value id="devdocs-base" type="host">https://devdocs.magento.com</value>
                <value id="magento" type="host">https://magento.com</value>
            </values>
        </policy>
        <policy id="connect-src">
            <values>
                <value id="devdocs" type="host">https://devdocs.magento.com</value>
            </values>
        </policy>
    </policies>
</csp_whitelist>

From: https://devdocs.magento.com/guides/v2.3/extension-dev-guide/security/content-security-policies.html

Related: Magento 2.3.5 Content Security Policy false positive cdn fonts

13
  • Thanks for your answer, in this case I'm mainly interested in the images/fonts/scripts with data:image/png;base64, data:application/javascript;base64, data:application/font-woff;base64
    – Materix
    Commented May 1, 2020 at 12:24
  • Do you need clear cache or something after doing this? It doesn't work for me
    – KaMZaTa
    Commented May 1, 2020 at 12:50
  • @KaMZaTa magento.stackexchange.com/questions/311661/…
    – Materix
    Commented May 1, 2020 at 13:16
  • It doesn't work for me. Did it work for you? I'm trying to whitelisting a script added in <head> through layout/default.xml file and placed in my_theme/web/js/myscript.js. It load the script but it is not whitelisted.
    – KaMZaTa
    Commented May 1, 2020 at 13:35
  • 4
    @CodeForGood just disable the module: magento module:disable Magento_Csp
    – KaMZaTa
    Commented Jun 11, 2020 at 12:55
0

If the above solution will not work then try the below one.

<policy id="img-src">
  <values>
    <value id="data-image" type="host">'self' data:</value>
  </values>
</policy>

It is working in the Magento2.4.2 commerce version.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.