Trang web này sẽ có chức năng hạn chế trong khi chúng tôi trải qua bảo trì để cải thiện trải nghiệm của bạn. Nếu một bài viết không giải quyết được vấn đề của bạn và bạn muốn đặt câu hỏi, chúng tôi có cộng đồng hỗ trợ của chúng tôi đang chờ để giúp bạn tại @FirefoxSupport trên Twitter và /r/firefox trên Reddit.

Tìm kiếm hỗ trợ

Tránh các lừa đảo về hỗ trợ. Chúng tôi sẽ không bao giờ yêu cầu bạn gọi hoặc nhắn tin đến số điện thoại hoặc chia sẻ thông tin cá nhân. Vui lòng báo cáo hoạt động đáng ngờ bằng cách sử dụng tùy chọn "Báo cáo lạm dụng".

Tìm hiểu thêm

won't display svg's using csp and default-src 'none'

  • 4 trả lời
  • 1 gặp vấn đề này
  • 8 lượt xem
  • Trả lời mới nhất được viết bởi thujal

more options

SVG's will not display in Firefox/mac since we've implemented a CSP that starts with default-src 'none'

We have published a proof of concept of this problem:

https://go-web.goodyear.portal.mccannbristol.co.uk/

The same website works fine in Firefox/Windows, and all other browsers. No amount of tweaking of the CSP header seems to allow SVG's to show, except if we remove the default-src 'none' directive. Full header is:

Content-Security-Policy "default-src 'none'; script-src 'self' https://www.google-analytics.com; connect-src 'self'; frame-src 'self' https://*.youtube.com https://*.youtube-nocookie.com https://*.doubleclick.net; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' https://www.google-analytics.com https://stats.g.doubleclick.net; frame-ancestors 'self'"

SVG's will not display in Firefox/mac since we've implemented a CSP that starts with default-src 'none' We have published a proof of concept of this problem: https://go-web.goodyear.portal.mccannbristol.co.uk/ The same website works fine in Firefox/Windows, and all other browsers. No amount of tweaking of the CSP header seems to allow SVG's to show, except if we remove the default-src 'none' directive. Full header is: Content-Security-Policy "default-src 'none'; script-src 'self' https://www.google-analytics.com; connect-src 'self'; frame-src 'self' https://*.youtube.com https://*.youtube-nocookie.com https://*.doubleclick.net; object-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self' https://www.google-analytics.com https://stats.g.doubleclick.net; frame-ancestors 'self'"

Tất cả các câu trả lời (4)

more options

thujal said

The same website works fine in Firefox/Windows

Not for me, I get this in the Web Console on Firefox 48.0.2/Windows:

Content Security Policy: The page's settings blocked the loading of a resource at https://go-web.goodyear.portal.mccannbristol.co.uk/a/svg/global.svg ("default-src 'none'").

(I get a bouncing span with no image in it in the Inspector.)

This implies that a more specific policy applicable to the image in the SVG element was not found. But... extensive searching has not turned up an explanation of what <svg><img></svg> <svg><use href="uri"></svg> requires.

In your CSP, this is the only other 'none', did you try:

object-src 'self';

Được chỉnh sửa bởi jscher2000 - Support Volunteer vào

more options

Yes, we have tried object-src. In fact, we've kept adding the different src elements in a bid to make this work, but it does not. For example:

Header always set Content-Security-Policy "default-src 'none'; script-src 'self' https://www.google-analytics.com; connect-src 'self'; frame-src 'self' https://*.youtube.com https://*.youtube-nocookie.com https://*.doubleclick.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://www.google-analytics.com https://stats.g.doubleclick.net; object-src 'self'; font-src 'self'; media-src 'self'; child-src 'self'; plugin-types 'image/svg+xml'; frame-ancestors 'self'"

Does not work.

However, setting a default-src of self does indeed work:

Header always set Content-Security-Policy "default-src 'self'; script-src 'self' https://www.google-analytics.com; connect-src 'self'; frame-src 'self' https://*.youtube.com https://*.youtube-nocookie.com https://*.doubleclick.net; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://www.google-analytics.com https://stats.g.doubleclick.net;"

Checking [https://content-security-policy.com|h.../content-security-policy.com] and other documentation, it doesn't look like there are any more headers for us to try to bring these SVG's in, so I simply see no way to have SVGs work in FF on a site with Content-Security-Policy "default-src 'none'... Which can't be the case, can it? I must be missing something really obvious!

Oh, and apologies, it also does not work in FF / win, this was an error our on testers part!

more options

I had trouble figuring out which part of the source code applies different content policies to different content types. If you or someone with you can search it out, that might shed light on how svg is evaluated.

https://dxr.mozilla.org/mozilla-release/source/

Alternately, you could submit a new bug:

https://bugzilla.mozilla.org/enter_bug.cgi