Add nonce attribute to auto-generated WebForms script(将 nonce 属性添加到自动生成的 WebForms 脚本)
问题描述
在我的网站上实现 CSP 标头时,我遇到了 webforms 添加到页面的自动生成的回发 JavaScript 的问题:
While implementing the CSP header on my website, I am facing problems with the automatically generated postback JavaScript that webforms adds to the page:
<script type="text/javascript">
//<![CDATA[
var theForm = document.forms['form1'];
if (!theForm) {
theForm = document.form1;
}
function __doPostBack(eventTarget, eventArgument) {
if (!theForm.onsubmit || (theForm.onsubmit() != false)) {
theForm.__EVENTTARGET.value = eventTarget;
theForm.__EVENTARGUMENT.value = eventArgument;
theForm.submit();
}
}
//]]>
</script>
为了支持其他一些内联脚本标签,我已经成功添加了 nonce 属性;但是我找不到修改这段生成的代码来做同样的事情的方法.我已经探索了 ClientScript.GetPostBackEventReference,但这似乎控制了其中的 JavaScript,与 标签本身的呈现无关.
To support some other inline script tags I have successfully added the nonce attribute; however I can find no way to modify this piece of generated code to do the same thing. I have explored ClientScript.GetPostBackEventReference, but this appears to control the JavaScript within, nothing about the rendering of the <script> tag itself.
解决方案不一定需要涉及添加 nonce 属性——任何符合的都可以.例如,如果有一个 ASP.NET 设置可以配置为将此脚本作为文件加载(我可以将其列入白名单),那就没问题了.
The solution does not necessarily need to involve adding the nonce attribute—anything that complies will do. For example, if there is an ASP.NET setting which can be configured to load this script as a file (which I can whitelist), that would be fine.
推荐答案
祝你好运在 ASP.NET 上使用 Webforms Scheme 实现一个好的 CSP - WebForms 控件将添加一大堆内联脚本,比如这个登录按钮:
Good luck implementing a good CSP on ASP.NET with Webforms Scheme - WebForms controls will add a whole bunch of inline scripts like on this login button:
<a id="btnLogin" class="btn btn-info pull-right" href="javascript:__doPostBack('btnLogin','')">Login</a>
如果你没有使用很多 <asp:... 控件,你可能没问题.
If you're not using many <asp:... controls, you might be alright.
要允许上面你想运行的脚本,你可以在script-src之后添加这个到你的CSP:
To allow the above script you want to run, you can add this to your CSP after script-src:
sha256-uVkxb0ccirYwSBxwdr2/4qtJEH1eBw7MslAgyLdAVVY="
它让您的浏览器知道它应该执行任何具有 sha256 哈希值的脚本.
It lets your browser know that it should execute any script that has that sha256 hash.
如果您使用的换行符与我使用的不同(我认为这是 Windows 风格),我给您的哈希可能不起作用.
The hash I've given you may not work if you're using different newlines to what I'm using (which I believe is windows style).
您还应该注意,如果您没有将默认表单 ID 更改为form1"以外的其他内容的页面.
You should also be careful that if you don't have a page which changes the default form id to something other than "form1".
这篇关于将 nonce 属性添加到自动生成的 WebForms 脚本的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持编程学习网!
本文标题为:将 nonce 属性添加到自动生成的 WebForms 脚本
基础教程推荐
- .NET SerialPort DataReceived 事件未触发 2022-01-01
- 禁止输入少量字符,例如'<'、'&a 2022-01-01
- C# 从 List<List<int>> 中删除重 2022-01-01
- 如何使用 .Net 检查 Active Directory 服务器是否已启动并正在运行? 2022-01-01
- 我应该在后面的代码中直接使用 Linq To SQL 还是使 2022-01-01
- 如果有人提交恶意软件Nuget包怎么办? 2022-01-01
- Moq It.Is<>不匹配 2022-01-01
- WPF 模态进度窗口 2022-01-01
- 当值可以是对象或空数组时反序列化 JSON 2022-01-01
- Azure Functions:CosmosDBTrigger 未在 Visual Studio 中触发 2022-01-01
