Htmx does not play well with content security policy • Hacker News Board

Re: Htmx does not play well with content security policy

#61

Post by Sjoerd » Wed, Jul 03, 2024, 8:09 AM UTC

OptionOfT wrote: post #59

This one surprised me: https://www.sjoerdlangkemper.nl/2024/06/26/htmx-content-secu... So, I get that `raw` prevents htmx from being used. I get that ` ` still works. But I find it scary that if `user_content` is ` ...` that is actually injected, as raw HTML. I would expect that the ` only has access to contents of the div it is in itself, and nothing more. But instead I understand that the HTML is injected as text (…

This differs for different template engines.

In Angular, for example, the template is parsed into a DOM tree, and then template variables are placed in the correct place. This makes injection really hard. In the above example, it would be impossible to break out of the div.

Other template engines just do a string search/replace, and this makes injection easy. Then it's indeed possible to break out of the div just by injecting .

The example you quoted comes directly from the HTMX docs. They don't specify which template system is used, and I don't immediately recognize the syntax to limit it to a specific template system.

Re: Htmx does not play well with content security policy

#62

Post by recursivedoubts » Wed, Jul 03, 2024, 10:59 PM UTC

htmx docs security section:

https://htmx.org/docs/#security

and security guide:

https://htmx.org/essays/web-security-basics-with-htmx/

Re: Htmx does not play well with content security policy

#63

Post by victorbjorklund » Fri, Jul 05, 2024, 6:16 AM UTC

mtlynch wrote: post #52

wccrawford wrote: post #38

Earlier quoted context omitted.

I think that's only true if your CSP has the word 'unsafe' or '*' in it. If it doesn't, it shouldn't allow inline code or things from domains that you didn't whitelist. And that's not HTMX or CSP's fault.

> I think that's only true if your CSP has the word 'unsafe' or '*' in it. No, that's the subtlety that a lot of people in the thread are missing. I wish OP did a better job of explaining the difference. Imagine that you screw up and some part of your page assigns injects an attacker-controlled string without encoding properly: So you have something like this: {{ user_message }} And the attacker can inject arbitrary…

Fair enough. It is a trade-off I guess.

Re: Htmx does not play well with content security policy

#64

Post by latent22 » Wed, Jul 10, 2024, 11:45 PM UTC

https://github.com/MichaelWest22/htmx-extensions/tree/main/s...

one great feature of htmx is how easy it is to understand and develop extensions for. I've just implemented this extension which allows safer handling of CSP nonce if this was required by an application. Hopefully this will get accepted as an official htmx extension.

My advice is if your not using inline script tags or the eval feature just keep it simple and disable allowScriptTags and allowEval and set a good CSP header. Also make sure you set a htmx-config meta tag in your page headers to set your config and protect from injected meta tags.

If you need inline scripts in a few places then be aware you need to choose a good templating or auto escaping engine on the backend to protect you and think about user inputs and be careful when using any raw escape override functions. If you have a sensitive application that needs regular external pen-testing then look at things like my safe-nonce extension that gives you another layer of protection to sell.