Skip to content
This repository has been archived by the owner on Mar 26, 2020. It is now read-only.

Fix inline javascript produced in generated static site #151

Open
zadigus opened this issue Jan 16, 2020 · 0 comments
Open

Fix inline javascript produced in generated static site #151

zadigus opened this issue Jan 16, 2020 · 0 comments
Assignees
@shikamu @zadigus
Labels
consumer-ui security
Milestone
Camponotus alacer

Comments

@zadigus
Copy link

zadigus commented Jan 16, 2020 •
edited
Loading

Here's a current sample output of nuxt generate:

<!doctype html>
<html data-n-head-ssr>
  <head>
    <title>La Budzonnerie</title><meta data-n-head="ssr" charset="utf-8"><meta data-n-head="ssr" name="viewport" content="width=device-width,initial-scale=1"><meta data-n-head="ssr" data-hid="description" name="description" content="Shopozor consumer ui"><link data-n-head="ssr" rel="icon" type="image/x-icon" href="/favicon.ico"><link rel="preload" href="/_nuxt/4d3f837581bb5c82dfeb.js" as="script"><link rel="preload" href="/_nuxt/187fe892e0c1168d09d6.js" as="script"><link rel="preload" href="/_nuxt/2039525ffb34ac1aeaaa.js" as="script"><link rel="preload" href="/_nuxt/fada160ba546af3cd21f.css" as="style"><link rel="preload" href="/_nuxt/72ed2f7cd4643df3f68f.js" as="script"><link rel="preload" href="/_nuxt/631508af0ae4cef5d3f1.css" as="style"><link rel="preload" href="/_nuxt/3e99611868eae76604d6.js" as="script"><link rel="stylesheet" href="/_nuxt/fada160ba546af3cd21f.css"><link rel="stylesheet" href="/_nuxt/631508af0ae4cef5d3f1.css">
  </head>
  <body>
    <div data-server-rendered="true" id="__nuxt"><!----><div id="__layout"><div><nav class="flex flex-no-wrap justify-start bg-orange-800 p-6"><div class="flex-grow-0 mr-4"><svg width="100" height="125" viewBox="50 75 110 125" xmlns="http://www.w3.org/2000/svg"><path d="m 121.40065,69.664592 c -2.17889,-0.42404 -7.71144,3.87711 -9.62273,10.80924 2.4534,0.16048 4.26606,1.29037 4.69622,2.92714 0.62757,2.4157 -1.90124,5.15992 -5.64553,6.1275 -3.74338,0.9668 -7.28284,-0.20875 -7.90375,-2.6251 -0.27922,-1.09466 0.0913,-2.31419 1.02812,-3.41615 -1.23688,0.62496 -2.39247,1.3162 -3.44486,2.08573 -3.288035,-5.27839 -11.932738,-9.43224 -14.772076,-9.81687 -0.476224,-0.0652 -0.781529,-0.0261 -0.878078,0.13047 -1.953432,3.24237 9.2544,7.55096 12.556914,12.42031 -3.843453,4.1956 -5.363585,9.40771 -3.96988,13.686018 1.007246,3.09037 4.301932,5.60496 8.4289,6.81783 1.3406,0.39403 0.98115,1.08162 0,1.57507 -1.12467,0.56494 -2.209547,1.21208 -3.121287,2.10008 -9.698267,-1.8698 -23.933708,-9.35343 -24.668006,-12.29088 -1.526004,-6.104408 -3.057096,-10.724298 -4.825648,-5.890178 -1.326512,3.62557 -3.850368,-3.93165 -7.61619,-4.12801 -1.255143,-0.0652 -2.642064,0.68629 -4.178505,2.94137 -3.445513,5.05632 1.611332,11.784388 9.780986,12.154278 7.938978,0.35879 21.525058,13.52606 26.27177,18.71312 0.491881,0.53754 1.116843,1.66913 0.481443,2.11443 -7.586181,5.31975 -14.484382,7.61971 -14.484382,11.35579 0,4.48041 12.381038,10.96671 11.319907,12.4995 -0.759349,1.09727 -10.379593,-1.65647 -7.314016,4.12097 0.649752,1.22513 1.510217,2.15253 2.531424,2.76875 -7.840733,1.03334 -17.134666,-3.21444 -23.840811,-10.88843 -2.114304,-2.43292 -3.667707,-6.62186 -5.818282,-5.68155 -2.150314,0.94071 0.260945,24.44699 23.10012,38.53382 3.32874,2.05311 6.736024,3.55485 10.111864,4.53091 0.260944,5.50019 0.89504,6.8314 -2.581916,8.60139 -4.585449,2.33441 -11.755685,8.0975 -7.170236,9.51482 4.585449,1.41732 14.512042,2.581 17.346683,0.49579 2.834642,-2.08416 3.414722,-5.91561 0.495795,-9.91746 -1.314378,-1.8026 -1.363697,-4.73223 -1.03595,-7.41474 5.291437,0.39925 10.330277,-0.5245 14.692877,-2.64663 3.45491,6.72167 3.13851,9.43863 2.92701,10.63676 -0.2492,1.41732 0.73587,2.82002 5.92619,3.17152 5.16905,0.34966 9.16594,0.0783 12.5209,-0.0261 3.25163,-0.10438 8.17109,-4.83452 3.08528,-7.33567 -5.08555,-2.50102 -7.76845,1.09988 -9.85275,-1.15077 -1.89315,-2.0445 -6.29698,-5.68337 -7.40756,-10.57921 2.1905,-2.32137 4.00119,-5.11582 5.28595,-8.37137 1.01508,-2.5733 1.64187,-5.35549 1.91299,-8.27063 2.45744,-0.0783 4.23604,-2.05547 4.10661,-3.6103 -0.23615,-2.82969 -2.30609,-1.88154 -2.82642,-3.90504 -1.06074,-4.12671 7.82782,-12.14423 6.71711,-14.25436 -0.87939,-1.67135 -7.21499,-5.90726 -11.20483,-13.17535 -0.60148,-1.09466 -1.30538,-2.72061 -0.51015,-3.66066 5.5075,-6.51266 21.97375,-15.62497 26.52358,-15.31145 3.19631,0.2205 5.02619,-0.3588 7.47946,-2.28692 6.49791,-5.106418 0.44491,-11.752678 -2.71852,-10.255508 -1.9366,0.91722 -3.16604,1.92068 -4.37983,1.33773 -0.96941,-0.46578 0.0913,-2.96224 -1.45998,-3.25072 -0.9655,-0.17874 -2.91384,4.24257 -4.0633,8.752478 -1.35952,5.33305 -20.24617,10.48527 -29.11972,10.63675 -0.66019,-0.38098 -1.36722,-0.68628 -2.08573,-0.94984 -0.90026,-0.33009 -1.14555,-0.96549 0,-1.32338 2.61884,-0.81806 5.68624,-2.12852 7.66655,-3.73255 5.16201,-4.18111 8.71725,-7.648148 10.21246,-12.276398 0.51536,-1.59567 1.11423,-2.55856 -0.18005,-4.27062 -1.20687,-1.59815 -5.96011,0.49449 -10.40647,3.22202 -4.4465,2.72817 -7.25309,5.90635 -13.77957,3.62465 -3.10172,-1.08423 -4.54527,-4.2885 -0.35228,-2.21647 5.54064,2.73809 9.31311,-1.14424 14.23257,-4.03459 4.91959,-2.88996 11.66449,-4.76655 12.12283,-2.27766 0.61453,3.33722 2.49555,3.60887 1.40506,-1.3543 -0.47883,-2.17993 -3.30095,-4.89127 -14.17516,-4.86166 -1.27733,0.004 -2.74227,0.0783 -4.2504,0.15787 2.34929,-6.27663 8.36001,-8.8151 7.41487,-10.59356 -0.14874,-0.28052 -0.39272,-0.45405 -0.7189,-0.51798 z m -9.66591,11.45664 c -0.50102,-0.003 -1.01377,0.0783 -1.51022,0.22311 -2.04907,0.61583 -3.34335,2.33454 -2.89114,3.84045 0.45405,1.50526 2.48198,2.22651 4.53092,1.61094 2.04893,-0.61583 3.34322,-2.33454 2.89113,-3.84045 -0.32748,-1.09727 -1.51817,-1.81918 -3.02069,-1.83392 z m 8.24193,52.191008 c 2.68382,1.57049 4.53587,3.76464 4.22156,5.08463 -0.14352,0.60148 -0.62105,1.9276 -1.17947,3.58877 -1.0216,-2.64428 -2.64089,-5.04666 -3.8261,-7.69525 -0.17092,-0.38098 0.42143,-1.18991 0.78414,-0.97854 z m -21.805703,2.61075 c 0.902869,3.97092 0.821976,7.77406 -0.223107,11.05374 -2.203025,-3.90569 -7.843864,-7.15928 -6.875368,-8.46478 1.22383,-1.65061 4.394698,-2.30101 7.098345,-2.58896 z" style="fill:#fff;fill-opacity:1;stroke:#000;stroke-width:0;stroke-miterlimit:4;stroke-dasharray:none;stroke-opacity:1"></path></svg></div> <div class="flex flex-col justify-between flex-grow text-white"><div class="hidden md:w-auto md:flex md:flex-row-reverse md:justify-start"><a href="/" class="mr-4 font-hairline border-b">Rejoindre les producteurs</a> <a href="/" class="mr-4 font-hairline border-b">Ouvrir une Budzonnerie</a></div> <div class="w-auto flex flex-col md:flex-row md:justify-between md:items-baseline"><div class="font-extrabold xs:text-2xl sm:text-4xl md:text-5xl lg:text-6xl">
        La Budzonnerie
      </div> <div><button class="inline-block text-sm px-4 py-2 leading-none border rounded text-white border-white hover:border-transparent hover:text-orange-800 hover:bg-white mt-4 uppercase">
          S'identifier
        </button></div></div></div></nav> <div><div><!----><!----><!----></div></div> <div class="bg-green-300 p-8"><div class="md:flex md:justify-start mb-4"><div class="h-auto"><span class="font-bold mb-2">
        Qui sommes-nous ?
      </span> <ul><li><a href="/">La Budzonnerie</a></li> <li>
          Softozor
        </li> <li>
          Contact
        </li></ul></div> <div class="h-auto mt-8 md:mt-0 md:ml-8"><span class="font-bold mb-2">
        Nous rejoindre
      </span> <ul><li>
          Rejoindre les producteurs
        </li> <li>
          Ouvrir une Budzonnerie
        </li> <li>
          Rejoindre l'équipe de développement
        </li></ul></div> <div class="h-auto mt-8 md:mt-0 md:ml-8"><span class="font-bold mb-2">
        Politiques
      </span> <ul><li>
          Cookies
        </li> <li>
          Mots de passe
        </li></ul></div> <div class="h-auto mt-8 md:mt-0 md:ml-8"><span class="font-bold mb-2">
        Légal
      </span> <ul><li>
          Conditions générales d'utilisation
        </li></ul></div></div></div></div></div></div><script>window.__NUXT__=function(e,i){return{layout:"default",data:[{}],error:null,serverRendered:!0,apollo:{defaultClient:Object.create(null,{"shops:1":{writable:!0,enumerable:!0,value:{description:"Ipsum sit veniam. Iure repudiandae iure dolorem enim voluptas. Perspiciatis dolores sequi sint.",latitude:46.807378,longitude:6.997913,id:1,name:"Amet minus nulla.",__typename:e}},"shops:2":{writable:!0,enumerable:!0,value:{description:"Corporis veritatis magnam autem recusandae sit labore. Nam eos nam nesciunt sapiente consequatur. Cupiditate iure assumenda deserunt inventore alias non labore.",latitude:46.723393,longitude:7.052267,id:2,name:"Veritatis necessitatibus non expedita debitis molestiae.",__typename:e}},"shops:3":{writable:!0,enumerable:!0,value:{description:"Ducimus modi temporibus reiciendis sint sint repudiandae blanditiis. Iste eaque excepturi odit nam. Provident laboriosam totam officia animi nesciunt tempore.",latitude:46.812647,longitude:7.052842,id:3,name:"Veniam assumenda similique.",__typename:e}},"shops:4":{writable:!0,enumerable:!0,value:{description:"Omnis inventore quae unde vero. Doloremque laudantium fuga. Deleniti numquam unde labore.",latitude:46.798091,longitude:7.003343,id:4,name:"Aliquid ducimus nisi consequatur pariatur amet.",__typename:e}},"shops:5":{writable:!0,enumerable:!0,value:{description:"Fugiat ab in veritatis facilis iusto at. Voluptatem sunt minus consectetur enim veniam aliquam ut. Quibusdam magnam a inventore.\nDicta autem eligendi esse eligendi.",latitude:46.801095,longitude:7.023126,id:5,name:"Explicabo quae doloremque.",__typename:e}},ROOT_QUERY:{writable:!0,enumerable:!0,value:{shops:[{type:i,generated:!1,id:"shops:1",typename:e},{type:i,generated:!1,id:"shops:2",typename:e},{type:i,generated:!1,id:"shops:3",typename:e},{type:i,generated:!1,id:"shops:4",typename:e},{type:i,generated:!1,id:"shops:5",typename:e}]}}})}}}("shops","id")</script><script src="/_nuxt/4d3f837581bb5c82dfeb.js" defer></script><script src="/_nuxt/3e99611868eae76604d6.js" defer></script><script src="/_nuxt/187fe892e0c1168d09d6.js" defer></script><script src="/_nuxt/2039525ffb34ac1aeaaa.js" defer></script><script src="/_nuxt/72ed2f7cd4643df3f68f.js" defer></script>
  </body>
</html>

We can see inline javascript at the bottom, which is not allowed by our security policy. One way to solve that issue might be to configure csp appropriately.
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees

@shikamu shikamu

@zadigus zadigus

Labels
consumer-ui security
Projects
None yet
Milestone
Camponotus alacer
Development

No branches or pull requests
2 participants
@shikamu @zadigus