227349 2021-06-24 06:04:29 -0700 Safari v14.1 CSP Violation - Usage of "element.removeAttribute("style")" causes style-src CSP Violation. 2023-05-22 12:08:35 -0700 1 1 1 Unclassified WebKit DOM Safari 14 All macOS 11 RESOLVED FIXED InRadar P2 Normal --- 1 ramya.vivid webkit-unassigned ahmad.saleem792 ap bfulgham cdumez nickygencs ramya.vivid rniwa webkit-bug-importer oldest_to_newest 1772253 0 432154 ramya.vivid 2021-06-24 06:04:29 -0700 Created attachment 432154 safari-CSP Usage of element.removeAttribute("style") in safari v14.1 throws the following CSP Violation. "Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy". Example: function removeStyle(){ document.getElementById("section").removeAttribute("style"); // throws above CSP violation } CSP used: default-src 'none'; connect-src 'self'; script-src 'self'; style-src 'self'; Reference: Attached HTML file. Steps to reproduce: 1. Open the demo html with safari v14.1 2. Open the console to check the violation reported 3. Click on change and remove color buttons 4. Remove button - is executing the following - element.removeAttribute("style") 5. On click of Remove - the above CSP violation will be reported in the console 1772550 1 432236 ramya.vivid 2021-06-24 22:40:27 -0700 Created attachment 432236 Updated safari-csp-issue html with text message 1772551 2 432237 ramya.vivid 2021-06-24 22:44:12 -0700 Created attachment 432237 Updated safari-csp-issue html with text message 1774085 3 webkit-bug-importer 2021-07-01 06:05:17 -0700 <rdar://problem/80020346> 1889870 4 ahmad.saleem792 2022-08-08 17:53:32 -0700 I am able to reproduce this bug in Safari 15.6 on macOS 12.5 and it gives following message in Console: Refused to apply a stylesheet because its hash, its nonce, or 'unsafe-inline' does not appear in the style-src directive of the Content Security Policy. While all other browsers does not show any such message in Console. Thanks! 1891497 5 charliew 2022-08-15 16:57:37 -0700 Pull request: https://github.com/WebKit/WebKit/pull/3333 1898032 6 ews-feeder 2022-09-12 15:09:25 -0700 Committed 254409@main (572f10393126): <https://commits.webkit.org/254409@main> Reviewed commits have been landed. Closing PR #3333 and removing active labels. 1957049 7 nickygencs 2023-05-22 12:06:49 -0700 What version on safari is this fixed in? 1957050 8 ahmad.saleem792 2023-05-22 12:08:35 -0700 (In reply to nickygencs from comment #7) > What version on safari is this fixed in? Safari 16.4 <- if I am not wrong. @jensimmons & others might be able to give precise information. 432154 2021-06-24 06:04:29 -0700 2021-06-24 06:04:29 -0700 safari-CSP safari-csp.html text/html 1848 ramya.vivid PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KICA8aGVhZD4KICAgIDxtZXRhIGNoYXJz ZXQ9InV0Zi04IiAvPgogICAgPHRpdGxlPlNhZmFyaTwvdGl0bGU+CiAgICA8bWV0YQogICAgICBo dHRwLWVxdWl2PSJDb250ZW50LVNlY3VyaXR5LVBvbGljeSIKICAgICAgY29udGVudD0iCiAgICAg ICAgZGVmYXVsdC1zcmMgJ25vbmUnOwogICAgICAgIGNvbm5lY3Qtc3JjICdzZWxmJzsKICAgICAg ICBzY3JpcHQtc3JjICdzZWxmJyAnc2hhMjU2LTJkdUh5U2xBS3dlbU04aUd3b01BdHZlTDNWSGcx RTduSGI3ZVFJREtpZTA9JyAnc2hhMjU2LXZ2dDRLV3d1TnI1MVhmRTVtK2h6ZU5FR2hpT2Zaekc5 N2NjZnFHc1B3dkU9JzsKICAgICAgICBzdHlsZS1zcmMgJ3NlbGYnICdzaGEyNTYtY0xRMjk4L0tB L2IzREhPQ2FkU2Nxb0phR205T2VtbFVvQzNOb1FhQ1Q1UT0nOwogICAgICAgICIKICAgIC8+CiAg ICA8c3R5bGU+CiAgICAgIC5mbGV4LXN0eWxlIHsKICAgICAgICBkaXNwbGF5OiBmbGV4OwogICAg ICAgIGp1c3RpZnktY29udGVudDogY2VudGVyOwogICAgICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7 CiAgICAgIH0KICAgICAgLnNlY3Rpb24gewogICAgICAgIGhlaWdodDogNTB2aDsKICAgICAgICB3 aWR0aDogMTAwdnc7CiAgICAgICAgYmFja2dyb3VuZDogcGFsZXR1cnF1b2lzZTsKICAgICAgfQog ICAgICAuYnV0dG9uIHsKICAgICAgICBiYWNrZ3JvdW5kLWNvbG9yOiAjNGE0NzQ3OwogICAgICAg IGJvcmRlcjogbm9uZTsKICAgICAgICBjb2xvcjogd2hpdGU7CiAgICAgICAgcGFkZGluZzogMTVw eCAzMnB4OwogICAgICAgIHRleHQtYWxpZ246IGNlbnRlcjsKICAgICAgICB0ZXh0LWRlY29yYXRp b246IG5vbmU7CiAgICAgICAgZGlzcGxheTogaW5saW5lLWJsb2NrOwogICAgICAgIGZvbnQtc2l6 ZTogMTZweDsKICAgICAgICBtYXJnaW46IDRweCAycHg7CiAgICAgICAgY3Vyc29yOiBwb2ludGVy OwogICAgICB9CiAgICA8L3N0eWxlPgogIDwvaGVhZD4KCiAgPGJvZHk+CiAgICA8ZGl2IGNsYXNz PSJjb250YWluZXIiPgogICAgICA8ZGl2IGNsYXNzPSJzZWN0aW9uIGZsZXgtc3R5bGUiIGlkPSJz ZWN0aW9uIj4KICAgICAgICA8YnV0dG9uIGNsYXNzPSJidXR0b24iIGlkPSJidG4iPkNoYW5nZSBD b2xvcjwvYnV0dG9uPgogICAgICAgIDxidXR0b24gY2xhc3M9ImJ1dHRvbiIgaWQ9InJlbW92ZWJ0 biI+UmVtb3ZlIEFwcGxpZWQgQ29sb3I8L2J1dHRvbj4KICAgICAgPC9kaXY+CiAgICA8L2Rpdj4K ICAgIDxzY3JpcHQ+CiAgICAgIGxldCBjb250YWluZXIgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ ZCgic2VjdGlvbiIpOwogICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiYnRuIikuYWRkRXZl bnRMaXN0ZW5lcigiY2xpY2siLCBzd2l0Y2hTdHlsZSk7CiAgICAgIGRvY3VtZW50CiAgICAgICAg LmdldEVsZW1lbnRCeUlkKCJyZW1vdmVidG4iKQogICAgICAgIC5hZGRFdmVudExpc3RlbmVyKCJj bGljayIsIHJlbW92ZVN0eWxlKTsKICAgICAgICAKICAgICAgZnVuY3Rpb24gc3dpdGNoU3R5bGUo KSB7CiAgICAgICAgbGV0IGNvbG9ycyA9IFsiIzIxOTZmMyIsICIjZjY2ODVlIiwgIiNmNzMzNzgi LCAiI2ZmYzEwNyIsICIjY2RkYzM5Il07CiAgICAgICAgY29udGFpbmVyLnN0eWxlLmJhY2tncm91 bmRDb2xvciA9CiAgICAgICAgICBjb2xvcnNbTWF0aC5mbG9vcihNYXRoLnJhbmRvbSgpICogY29s b3JzLmxlbmd0aCldOwogICAgICB9CgogICAgICBmdW5jdGlvbiByZW1vdmVTdHlsZSgpIHsKICAg ICAgICBjb250YWluZXIucmVtb3ZlQXR0cmlidXRlKCJzdHlsZSIpOwogICAgICB9CiAgICA8L3Nj cmlwdD4KICA8L2JvZHk+CjwvaHRtbD4K 432236 2021-06-24 22:40:27 -0700 2021-06-24 22:44:12 -0700 Updated safari-csp-issue html with text message safari-csp.html text/html 2315 ramya.vivid PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KICA8aGVhZD4KICAgIDxtZXRhIGNoYXJz ZXQ9InV0Zi04IiAvPgogICAgPHRpdGxlPlNhZmFyaTwvdGl0bGU+CiAgICA8bWV0YQogICAgICBo dHRwLWVxdWl2PSJDb250ZW50LVNlY3VyaXR5LVBvbGljeSIKICAgICAgY29udGVudD0iCiAgICAg ICAgZGVmYXVsdC1zcmMgJ25vbmUnOwogICAgICAgIGNvbm5lY3Qtc3JjICdzZWxmJzsKICAgICAg ICBzY3JpcHQtc3JjICdzZWxmJyAnc2hhMjU2LWNBeE1RVFJmTDV4a2xZOW43Y3lhTnAwdjIxM1Jm NitSWXpkT3cvU1I3dW89JyAnc2hhMjU2LXZ2dDRLV3d1TnI1MVhmRTVtK2h6ZU5FR2hpT2Zaekc5 N2NjZnFHc1B3dkU9JzsKICAgICAgICBzdHlsZS1zcmMgJ3NlbGYnICdzaGEyNTYtN0YvbGhtNlRl VUlBZmdzcVpuTk11QkxGR3lGay9MZFdxK21vR3dnbFZ1OD0nOwogICAgICAgICIKICAgIC8+CiAg ICA8c3R5bGU+CiAgICAgIC5mbGV4LXN0eWxlIHsKICAgICAgICBkaXNwbGF5OiBmbGV4OwogICAg ICAgIGp1c3RpZnktY29udGVudDogY2VudGVyOwogICAgICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7 CiAgICAgIH0KICAgICAgLnNlY3Rpb24gewogICAgICAgIGhlaWdodDogNTB2aDsKICAgICAgICB3 aWR0aDogMTAwdnc7CiAgICAgICAgYmFja2dyb3VuZDogcGFsZXR1cnF1b2lzZTsKICAgICAgICBk aXNwbGF5OiBmbGV4OwogICAgICAgIGZsZXgtZGlyZWN0aW9uOiBDT0xVTU47CiAgICAgICAganVz dGlmeS1jb250ZW50OiBjZW50ZXI7CiAgICAgIH0KICAgICAgLmJ1dHRvbiB7CiAgICAgICAgYmFj a2dyb3VuZC1jb2xvcjogIzRhNDc0NzsKICAgICAgICBib3JkZXI6IG5vbmU7CiAgICAgICAgY29s b3I6IHdoaXRlOwogICAgICAgIHBhZGRpbmc6IDE1cHggMzJweDsKICAgICAgICB0ZXh0LWFsaWdu OiBjZW50ZXI7CiAgICAgICAgdGV4dC1kZWNvcmF0aW9uOiBub25lOwogICAgICAgIGRpc3BsYXk6 IGlubGluZS1ibG9jazsKICAgICAgICBmb250LXNpemU6IDE2cHg7CiAgICAgICAgbWFyZ2luOiA0 cHggMnB4OwogICAgICAgIGN1cnNvcjogcG9pbnRlcjsKICAgICAgfQogICAgPC9zdHlsZT4KICA8 L2hlYWQ+CgogIDxib2R5PgogICAgPGRpdiBjbGFzcz0iY29udGFpbmVyIj4KICAgICAgPGRpdiBj bGFzcz0ic2VjdGlvbiIgaWQ9InNlY3Rpb24iPgogICAgICAgIDxkaXYgY2xhc3M9ImZsZXgtc3R5 bGUiPgogICAgICAgICAgPGJ1dHRvbiBjbGFzcz0iYnV0dG9uIiBpZD0iYnRuIj5DaGFuZ2UgQ29s b3I8L2J1dHRvbj4KICAgICAgICAgIDxidXR0b24gY2xhc3M9ImJ1dHRvbiIgaWQ9InJlbW92ZWJ0 biI+UmVtb3ZlIEFwcGxpZWQgQ29sb3I8L2J1dHRvbj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8 aDUgY2xhc3M9ImZsZXgtc3R5bGUiIGlkPSJtZXNzYWdlIj4KICAgICAgICAgIHJlbW92ZUF0dHJp YnV0ZSgic3R5bGUiKSBhcHBsaWVkLiBDaGVjayBjb25zb2xlIHRvIHNlZSBlcnJvciBpbiBzYWZh cmkKICAgICAgICAgIHYxNC4xCiAgICAgICAgPC9oNT4KICAgICAgPC9kaXY+CiAgICA8L2Rpdj4K ICAgIDxzY3JpcHQ+CiAgICAgIGxldCBjb250YWluZXIgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ ZCgic2VjdGlvbiIpOwogICAgICBsZXQgbWVzc2FnZSA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlk KCJtZXNzYWdlIik7CiAgICAgIG1lc3NhZ2Uuc3R5bGUudmlzaWJpbGl0eSA9ICJoaWRkZW4iOwog ICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiYnRuIikuYWRkRXZlbnRMaXN0ZW5lcigiY2xp Y2siLCBzd2l0Y2hTdHlsZSk7CiAgICAgIGRvY3VtZW50CiAgICAgICAgLmdldEVsZW1lbnRCeUlk KCJyZW1vdmVidG4iKQogICAgICAgIC5hZGRFdmVudExpc3RlbmVyKCJjbGljayIsIHJlbW92ZVN0 eWxlKTsKCiAgICAgIGZ1bmN0aW9uIHN3aXRjaFN0eWxlKCkgewogICAgICAgIGxldCBjb2xvcnMg PSBbIiMyMTk2ZjMiLCAiI2Y2Njg1ZSIsICIjZjczMzc4IiwgIiNmZmMxMDciLCAiI2NkZGMzOSJd OwogICAgICAgIGNvbnRhaW5lci5zdHlsZS5iYWNrZ3JvdW5kQ29sb3IgPQogICAgICAgICAgY29s b3JzW01hdGguZmxvb3IoTWF0aC5yYW5kb20oKSAqIGNvbG9ycy5sZW5ndGgpXTsKICAgICAgICBt ZXNzYWdlLnN0eWxlLnZpc2liaWxpdHkgPSAiaGlkZGVuIjsKICAgICAgfQoKICAgICAgZnVuY3Rp b24gcmVtb3ZlU3R5bGUoKSB7CiAgICAgICAgbWVzc2FnZS5zdHlsZS52aXNpYmlsaXR5ID0gInZp c2libGUiOwogICAgICAgIGNvbnRhaW5lci5yZW1vdmVBdHRyaWJ1dGUoInN0eWxlIik7CiAgICAg IH0KICAgIDwvc2NyaXB0PgogIDwvYm9keT4KPC9odG1sPgo= 432237 2021-06-24 22:44:12 -0700 2021-06-24 22:44:12 -0700 Updated safari-csp-issue html with text message safari-csp.html text/html 2315 ramya.vivid PCFET0NUWVBFIGh0bWw+CjxodG1sIGxhbmc9ImVuIj4KICA8aGVhZD4KICAgIDxtZXRhIGNoYXJz ZXQ9InV0Zi04IiAvPgogICAgPHRpdGxlPlNhZmFyaTwvdGl0bGU+CiAgICA8bWV0YQogICAgICBo dHRwLWVxdWl2PSJDb250ZW50LVNlY3VyaXR5LVBvbGljeSIKICAgICAgY29udGVudD0iCiAgICAg ICAgZGVmYXVsdC1zcmMgJ25vbmUnOwogICAgICAgIGNvbm5lY3Qtc3JjICdzZWxmJzsKICAgICAg ICBzY3JpcHQtc3JjICdzZWxmJyAnc2hhMjU2LUJ3U2k4QVR4K25qMG9oSkRGSVc5SkxRNjR5TkRY YkFtdkJMdFUwUno2dkU9JyAnc2hhMjU2LXZ2dDRLV3d1TnI1MVhmRTVtK2h6ZU5FR2hpT2Zaekc5 N2NjZnFHc1B3dkU9JzsKICAgICAgICBzdHlsZS1zcmMgJ3NlbGYnICdzaGEyNTYtN0YvbGhtNlRl VUlBZmdzcVpuTk11QkxGR3lGay9MZFdxK21vR3dnbFZ1OD0nOwogICAgICAgICIKICAgIC8+CiAg ICA8c3R5bGU+CiAgICAgIC5mbGV4LXN0eWxlIHsKICAgICAgICBkaXNwbGF5OiBmbGV4OwogICAg ICAgIGp1c3RpZnktY29udGVudDogY2VudGVyOwogICAgICAgIGFsaWduLWl0ZW1zOiBjZW50ZXI7 CiAgICAgIH0KICAgICAgLnNlY3Rpb24gewogICAgICAgIGhlaWdodDogNTB2aDsKICAgICAgICB3 aWR0aDogMTAwdnc7CiAgICAgICAgYmFja2dyb3VuZDogcGFsZXR1cnF1b2lzZTsKICAgICAgICBk aXNwbGF5OiBmbGV4OwogICAgICAgIGZsZXgtZGlyZWN0aW9uOiBDT0xVTU47CiAgICAgICAganVz dGlmeS1jb250ZW50OiBjZW50ZXI7CiAgICAgIH0KICAgICAgLmJ1dHRvbiB7CiAgICAgICAgYmFj a2dyb3VuZC1jb2xvcjogIzRhNDc0NzsKICAgICAgICBib3JkZXI6IG5vbmU7CiAgICAgICAgY29s b3I6IHdoaXRlOwogICAgICAgIHBhZGRpbmc6IDE1cHggMzJweDsKICAgICAgICB0ZXh0LWFsaWdu OiBjZW50ZXI7CiAgICAgICAgdGV4dC1kZWNvcmF0aW9uOiBub25lOwogICAgICAgIGRpc3BsYXk6 IGlubGluZS1ibG9jazsKICAgICAgICBmb250LXNpemU6IDE2cHg7CiAgICAgICAgbWFyZ2luOiA0 cHggMnB4OwogICAgICAgIGN1cnNvcjogcG9pbnRlcjsKICAgICAgfQogICAgPC9zdHlsZT4KICA8 L2hlYWQ+CgogIDxib2R5PgogICAgPGRpdiBjbGFzcz0iY29udGFpbmVyIj4KICAgICAgPGRpdiBj bGFzcz0ic2VjdGlvbiIgaWQ9InNlY3Rpb24iPgogICAgICAgIDxkaXYgY2xhc3M9ImZsZXgtc3R5 bGUiPgogICAgICAgICAgPGJ1dHRvbiBjbGFzcz0iYnV0dG9uIiBpZD0iYnRuIj5DaGFuZ2UgQ29s b3I8L2J1dHRvbj4KICAgICAgICAgIDxidXR0b24gY2xhc3M9ImJ1dHRvbiIgaWQ9InJlbW92ZWJ0 biI+UmVtb3ZlIEFwcGxpZWQgQ29sb3I8L2J1dHRvbj4KICAgICAgICA8L2Rpdj4KICAgICAgICA8 aDUgY2xhc3M9ImZsZXgtc3R5bGUiIGlkPSJtZXNzYWdlIj4KICAgICAgICAgIHJlbW92ZUF0dHJp YnV0ZSgic3R5bGUiKSBhcHBsaWVkLiBDaGVjayBjb25zb2xlIHRvIHNlZSBlcnJvciBpbiBzYWZh cmkKICAgICAgICAgIHYxNC4xCiAgICAgICAgPC9oNT4KICAgICAgPC9kaXY+CiAgICA8L2Rpdj4K ICAgIDxzY3JpcHQ+CiAgICAgIGxldCBjb250YWluZXIgPSBkb2N1bWVudC5nZXRFbGVtZW50QnlJ ZCgic2VjdGlvbiIpOwogICAgICBsZXQgbWVzc2FnZSA9IGRvY3VtZW50LmdldEVsZW1lbnRCeUlk KCJtZXNzYWdlIik7CiAgICAgIG1lc3NhZ2Uuc3R5bGUudmlzaWJpbGl0eSA9ICJoaWRkZW4iOwog ICAgICBkb2N1bWVudC5nZXRFbGVtZW50QnlJZCgiYnRuIikuYWRkRXZlbnRMaXN0ZW5lcigiY2xp Y2siLCBzd2l0Y2hTdHlsZSk7CiAgICAgIGRvY3VtZW50CiAgICAgICAgLmdldEVsZW1lbnRCeUlk KCJyZW1vdmVidG4iKQogICAgICAgIC5hZGRFdmVudExpc3RlbmVyKCJjbGljayIsIHJlbW92ZVN0 eWxlKTsKCiAgICAgIGZ1bmN0aW9uIHN3aXRjaFN0eWxlKCkgewogICAgICAgIGxldCBjb2xvcnMg PSBbIiMyMTk2ZjMiLCAiI2Y2Njg1ZSIsICIjZjczMzc4IiwgIiNmZmMxMDciLCAiI2NkZGMzOSJd OwogICAgICAgIGNvbnRhaW5lci5zdHlsZS5iYWNrZ3JvdW5kQ29sb3IgPQogICAgICAgICAgY29s b3JzW01hdGguZmxvb3IoTWF0aC5yYW5kb20oKSAqIGNvbG9ycy5sZW5ndGgpXTsKICAgICAgICBt ZXNzYWdlLnN0eWxlLnZpc2liaWxpdHkgPSAiaGlkZGVuIjsKICAgICAgfQoKICAgICAgZnVuY3Rp b24gcmVtb3ZlU3R5bGUoKSB7CiAgICAgICAgbWVzc2FnZS5zdHlsZS52aXNpYmlsaXR5ID0gInZp c2libGUiOwogICAgICAgIGNvbnRhaW5lci5yZW1vdmVBdHRyaWJ1dGUoInN0eWxlIik7CiAgICAg IH0KICAgIDwvc2NyaXB0PgogIDwvYm9keT4KPC9odG1sPgo=