{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/13","repository_url":"https://api.github.com/repos/w3c/webappsec-csp","labels_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/13/labels{/name}","comments_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/13/comments","events_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/13/events","html_url":"https://github.com/w3c/webappsec-csp/issues/13","id":110163041,"number":13,"title":"Inline event handlers not whitelisted by hashes?","user":{"login":"mikewest","id":1497,"avatar_url":"https://avatars.githubusercontent.com/u/1497?v=3","gravatar_id":"","url":"https://api.github.com/users/mikewest","html_url":"https://github.com/mikewest","followers_url":"https://api.github.com/users/mikewest/followers","following_url":"https://api.github.com/users/mikewest/following{/other_user}","gists_url":"https://api.github.com/users/mikewest/gists{/gist_id}","starred_url":"https://api.github.com/users/mikewest/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mikewest/subscriptions","organizations_url":"https://api.github.com/users/mikewest/orgs","repos_url":"https://api.github.com/users/mikewest/repos","events_url":"https://api.github.com/users/mikewest/events{/privacy}","received_events_url":"https://api.github.com/users/mikewest/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/w3c/webappsec-csp/labels/CSP","name":"CSP","color":"ededed"}],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-10-07T06:50:59Z","updated_at":"2016-02-21T00:35:01Z","closed_at":null,"body":"_From @kravietz on September 8, 2015 15:54_\n\nReading through section 7.15 of the latest CSP2 editor's draft it seems like you can't whitelist an inline event handler with its SHA256 hash. Is this intended exclusion?\r\n\r\nJust to provide a bit of background, the following script will only result in one pop-up, from the whitelisted `alert` in the `<script>` tag:\r\n\r\n```\r\n<!DOCUMENT html>\r\n<html>\r\n<head>\r\n<meta http-equiv=\"Content-Security-Policy\" content=\"default-src none; script-src 'sha256-qznLcsROx4GACP2dm0UCKCzCG-HiZ1guq6ZZDob_Tng='; img-src data:\">\r\n</head>\r\n<body>\r\n<img src=\"data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg'/>\"\r\nonload=\"alert('Hello, world.');\">\r\n<script>alert('Hello, world.');</script>\r\n</body>\r\n</html>\r\n```\r\n\r\nThe inline handler `alert` will **not** be shown and Chrome will display the following error message:\r\n\r\n```\r\nRefused to execute inline event handler because it violates the following Content Security Policy \r\ndirective: \"script-src 'sha256-qznLcsROx4GACP2dm0UCKCzCG-HiZ1guq6ZZDob_Tng='\". \r\nEither the 'unsafe-inline' keyword, a hash ('sha256-...'), or a nonce ('nonce-...') is required to\r\nenable inline execution.\r\n```\r\n\r\nWhich on the other hand suggests that a hash *could* be used to whitelist it (but this may be just a Chrome catch-all message).\n\n_Copied from original issue: w3c/webappsec#468_"},"comment":{"url":"https://api.github.com/repos/w3c/webappsec-csp/issues/comments/186708533","html_url":"https://github.com/w3c/webappsec-csp/issues/13#issuecomment-186708533","issue_url":"https://api.github.com/repos/w3c/webappsec-csp/issues/13","id":186708533,"user":{"login":"michaelficarra","id":218840,"avatar_url":"https://avatars.githubusercontent.com/u/218840?v=3","gravatar_id":"","url":"https://api.github.com/users/michaelficarra","html_url":"https://github.com/michaelficarra","followers_url":"https://api.github.com/users/michaelficarra/followers","following_url":"https://api.github.com/users/michaelficarra/following{/other_user}","gists_url":"https://api.github.com/users/michaelficarra/gists{/gist_id}","starred_url":"https://api.github.com/users/michaelficarra/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/michaelficarra/subscriptions","organizations_url":"https://api.github.com/users/michaelficarra/orgs","repos_url":"https://api.github.com/users/michaelficarra/repos","events_url":"https://api.github.com/users/michaelficarra/events{/privacy}","received_events_url":"https://api.github.com/users/michaelficarra/received_events","type":"User","site_admin":false},"created_at":"2016-02-21T00:35:01Z","updated_at":"2016-02-21T00:35:01Z","body":":-1: I think there is a very real security risk here. A developer attempting to whitelist an inline script/style for a particular use may not be aware that it could be abused to apply malicious behaviour/styling to another element. And even if they were aware of this, it would be difficult to evaluate all the ways that this behaviour/styling could be used maliciously on every other element on the page."}}