{"action":"created","issue":{"url":"https://api.github.com/repos/angular/angular-cli/issues/3430","repository_url":"https://api.github.com/repos/angular/angular-cli","labels_url":"https://api.github.com/repos/angular/angular-cli/issues/3430/labels{/name}","comments_url":"https://api.github.com/repos/angular/angular-cli/issues/3430/comments","events_url":"https://api.github.com/repos/angular/angular-cli/issues/3430/events","html_url":"https://github.com/angular/angular-cli/issues/3430","id":193767650,"node_id":"MDU6SXNzdWUxOTM3Njc2NTA=","number":3430,"title":"Making angular-cli work with strict CSP?","user":{"login":"magnattic","id":7560166,"node_id":"MDQ6VXNlcjc1NjAxNjY=","avatar_url":"https://avatars3.githubusercontent.com/u/7560166?v=4","gravatar_id":"","url":"https://api.github.com/users/magnattic","html_url":"https://github.com/magnattic","followers_url":"https://api.github.com/users/magnattic/followers","following_url":"https://api.github.com/users/magnattic/following{/other_user}","gists_url":"https://api.github.com/users/magnattic/gists{/gist_id}","starred_url":"https://api.github.com/users/magnattic/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/magnattic/subscriptions","organizations_url":"https://api.github.com/users/magnattic/orgs","repos_url":"https://api.github.com/users/magnattic/repos","events_url":"https://api.github.com/users/magnattic/events{/privacy}","received_events_url":"https://api.github.com/users/magnattic/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":17,"created_at":"2016-12-06T13:07:00Z","updated_at":"2018-08-22T15:27:39Z","closed_at":"2016-12-06T17:57:39Z","author_association":"NONE","body":"> Please provide us with the following information:\r\n> ---------------------------------------------------------------\r\n\r\n### OS?\r\nWindows 7\r\n\r\n### Versions.\r\nangular-cli: 1.0.0-beta.21\r\nnode: 6.6.0\r\nos: win32 x64\r\nchrome: 54.0.2840.99 m (64-bit)\r\n\r\n### Repro steps.\r\n1. Run `ng new csp-test`\r\n1. Add the following meta tag to index.html:\r\n`  <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'none';\r\n    script-src 'self';\r\n    style-src 'self';\r\n    img-src 'self';\r\n    connect-src 'self' ws://localhost:4200;\r\n    font-src 'self';\">`\r\n1. Run `ng serve -aot`\r\n1. Open `localhost:4200` in chrome\r\n\r\n### The log given by the failure.\r\nThe following errors show up in the Chrome debugger console:\r\n\r\n>Refused to apply inline style because it violates the following Content Security Policy directive: \"style-src 'self'\". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution.\r\n> insertStyleElement @ addStyles.js:115\r\n>\r\n>Refused to apply inline style because it violates the following Content Security Policy directive: \"style-src 'self'\". Either the 'unsafe-inline' keyword, a hash ('sha256-xylbkVtqJQuRDTD/O50Zkbb0PJR006+vxsulnu5EOD4='), or a nonce ('nonce-...') is required to enable inline execution.\r\n> applyToTag @ addStyles.js:225\r\n>\r\n>Refused to apply inline style because it violates the following Content Security Policy directive: \"style-src 'self'\". Either the 'unsafe-inline' keyword, a hash ('sha256-47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU='), or a nonce ('nonce-...') is required to enable inline execution.\r\n> DomSharedStylesHost._addStylesToHost @ shared_styles_host.js:55\r\n\r\n### Mention any other details that might be useful.\r\nIs there any way to make angular2 with angular-cli work with a strict Content Security Policy? I realize I can add 'unsafe-inline', but that defeats a lot of the purpose of CSP.\r\n"},"comment":{"url":"https://api.github.com/repos/angular/angular-cli/issues/comments/415073462","html_url":"https://github.com/angular/angular-cli/issues/3430#issuecomment-415073462","issue_url":"https://api.github.com/repos/angular/angular-cli/issues/3430","id":415073462,"node_id":"MDEyOklzc3VlQ29tbWVudDQxNTA3MzQ2Mg==","user":{"login":"clydin","id":19598772,"node_id":"MDQ6VXNlcjE5NTk4Nzcy","avatar_url":"https://avatars2.githubusercontent.com/u/19598772?v=4","gravatar_id":"","url":"https://api.github.com/users/clydin","html_url":"https://github.com/clydin","followers_url":"https://api.github.com/users/clydin/followers","following_url":"https://api.github.com/users/clydin/following{/other_user}","gists_url":"https://api.github.com/users/clydin/gists{/gist_id}","starred_url":"https://api.github.com/users/clydin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/clydin/subscriptions","organizations_url":"https://api.github.com/users/clydin/orgs","repos_url":"https://api.github.com/users/clydin/repos","events_url":"https://api.github.com/users/clydin/events{/privacy}","received_events_url":"https://api.github.com/users/clydin/received_events","type":"User","site_admin":false},"created_at":"2018-08-22T15:27:39Z","updated_at":"2018-08-22T15:27:39Z","author_association":"CONTRIBUTOR","body":"That is Subresource Integrity ([SRI](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity)) not CSP.  This is already supported within the CLI by using the `subresourceIntegrity` option.\r\n\r\nIt is generally used when files are stored by a third-party and authenticity is required.  Generally if the files are self hosted and HTTPS is used, an attacker would need access to the server.  And in which case they could also modify the hashes as well.  However, as an extra layer of protection, it doesn't have much downside."}}
{"actor":{"display_login":"clydin"}}