-1

I run a Laravel application not developed by me, as I'm not a developer. This Laravel app show a user page interface where I need put a custom script live chat code.

I found where is the relative blade page where I need put that code and the patch is on app/Modules/KnowledgeBase/Resources/view/layouts/page.blade.php

  1. app is the folder where the app is installed, inside all core files.
  2. All requests inside this app folder are redirected to the public folder by an htaccess file, the public folder is inside the app folder so app/public/
  3. In the public folder there are a lot of files and folders. One of this folder is a symbolic link folder called modules, inside that folder there are all modules linked as symbolic links.
  4. I click on the symbolic links knowledgebase
  5. here I'm able to place a test HTML file with also the live chat script who works. This is just a test to see if I'm able to reach the location where I'm from the browser and to check the chat script works.
  6. In this folder only two folders are present. I need click on the button to load the parent directory and when I do I'm inside the following patch: app/Modules/KnowledgeBase/
  7. Now I open the resources , view, layouts folders and I reach the page.blade.php

My script inserted on this file never work. I'm also unable to reach a test.html file located at app/Modules/KnowledgeBase/Resources/view/layouts/ this because all browser requests are redirected to the public folder so the browser will load a not found page.

If I put the script inside this page I get the error "The script loading a resource to inline was blocked by page settings (“script-src”)"

I'm asking where this directive is set and how to fix to have my script run in the page.blade.php

The only .htaccess file I see is placed in the app folder and his content is

<IfModule mod_rewrite.c> RewriteEngine on RewriteCond %{REQUEST_URI} !/\.well\-known/?.* RewriteRule (.*) public/$1 [L] </IfModule>

There is also an .htaccess file placed in the public directory with the following code:

<IfModule mod_rewrite.c> <IfModule mod_negotiation.c> Options -MultiViews -Indexes </IfModule> RewriteEngine On # Handle Authorization Header RewriteCond %{HTTP:Authorization} . RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}] # Redirect Trailing Slashes If Not A Folder... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_URI} (.+)/$ RewriteRule ^ %1 [L,R=301] # Handle Front Controller... RewriteCond %{REQUEST_FILENAME} !-d RewriteCond %{REQUEST_FILENAME} !-f RewriteRule ^ index.php [L] </IfModule>

I don't understand why I'm unable to see my script code loaded inside the page.blade.php

I expect to be able to run the script inside the blade.php page. I searched on the web for a solution find some meta tag to add to the page but never resolve.

The script is correctly inserted in the page, the issue is locked by a directive that I don't know where can be placed and how to change for allow my script.

In the app/config I found a php file that inside has:

 'csp_enabled' => env('APP_CSP_ENABLED', true), 'csp_script_src' => env('APP_CSP_SCRIPT_SRC', ''),

Maybe is this directive that is forbid my script? How to resolve? Set to false resolve the issue but create maybe a XSS weakness. How I can allow my script leaving this option true?

Improve this question
5
  • Does this answer your question? Content Security Policy: The page's settings blocked the loading of a resource Commented Feb 8, 2024 at 16:03
  • No sorry. I already tried to put the meta tag and did not change. The issue seems to be not a server side issue as in other place of the app folder I can run a test html page with the script. The issue is on the specific blade page and his location. Commented Feb 8, 2024 at 16:28
  • are you serving this script from the same application, inline or it's own file or from a remote url? Commented Feb 8, 2024 at 16:47
  • Its a live chat code of a live chat in the same domain but different subdomain. The Laravel Help desk page where I want put the code is on helpdesk.domain.ext and the live chat code is a script that call the live chat on livechat.domain.ext Commented Feb 8, 2024 at 17:41
  • In the app/config folder I found the a php file where ---- 'csp_enabled' => env('APP_CSP_ENABLED', true), 'csp_script_src' => env('APP_CSP_SCRIPT_SRC', ''), ---- Maybe is this that are forbidding my script adding? Commented Feb 8, 2024 at 22:20

2 Answers 2

Reset to default
0

There is a content security policy set on your site. Inspect the response headers to see the content of it (look for Content-Security-Policy in the returned headers). Adding a CSP in a meta tag just adds another policy and your content still needs to pass the existing policy.

Now you need to modify the content of the policy or the way you load your script. If the policy allows 'self' and you can run your script from a .js file instead of as an inline script, that will solve your problem. If you need to run the script inline you will need to modify the policy for the script-src attribute (or script-src-elem if that is implemented). If your script doesn't change you can add the hash value that some browsers will give you in the error message. If your script is dynamic you'll need to add insert a dynamically computed hash or use a nonce. Avoid adding 'unsafe-inline' as it makes your CSP much less effective in preventing XSS.

Improve this answer
Sign up to request clarification or add additional context in comments.

4 Comments

I found the guide: github.com/freescout-helpdesk/freescout/wiki/… I need add the script using <script type="text/javascript" {!! \Helper::cspNonceAttr() !!}> // Some JS code </script> but I dont know how to customize this to work. I need put a randoom string for nonce? Where, how?
You can use a nonce, in that case you need to generate a new random nonce value for each pageload and put it in the CSP and in the nonce attribute of the script. But this is complex and not always possible. If your script is static use a hash instead or load it from a file.
I dont know how to load from a file. <script src="url"> is still be blocked.
<script src="<URL>">, if the url is relative or the same origin, it will be covered by 'self' in script-src. Otherwise you'll need to add 'self' or the host of the file.
0

The solution is consult the documentation of the app:

https://github.com/freescout-helpdesk/freescout/wiki/Development-Guide#javascript-and-content-security-policy-csp

Then after adding the script between the template:

<script type="text/javascript" {!! \Helper::cspNonceAttr() !!}> // Some JS code </script>

Need to check the page with the developer console. If you see some script are blocked is because the script use external script so need whitelist the domain in the .env file as the guide say:

APP_CSP_SCRIPT_SRC="example.org/js/script.js example.org/js/another-script.js"

Clean the app cache and all should work

Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.