[java-identity-provider] branch main updated: Replace hardcoded hash with nonce for user-prefs script.

Wed Dec 13 19:41:56 UTC 2023

This is an automated email from the git hooks/post-receive script.

scantor pushed a commit to branch main
in repository java-identity-provider.

View the commit online:
http://git.shibboleth.net/view/?p=java-identity-provider.git;a=commit;h=27dcf16e784a0411ab31a4f5821ce626b5308b4e

The following commit(s) were added to refs/heads/main by this push:
     new 27dcf16e7 Replace hardcoded hash with nonce for user-prefs script.
27dcf16e7 is described below

commit 27dcf16e784a0411ab31a4f5821ce626b5308b4e
Author: Scott Cantor <cantor.2 at osu.edu>
AuthorDate: Wed Dec 13 14:41:53 2023 -0500

    Replace hardcoded hash with nonce for user-prefs script.
---
 .../main/resources/net/shibboleth/idp/module/views/user-prefs.js    | 2 --
 .../main/resources/net/shibboleth/idp/module/views/user-prefs.vm    | 6 +++---
 2 files changed, 3 insertions(+), 5 deletions(-)

diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js
index 392a34e65..fcb900379 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.js
@@ -1,4 +1,3 @@
-<!--
 "use strict";
 
 function createCookie(name, value, seconds) {
@@ -44,4 +43,3 @@ function check(checkbox) {
         eraseCookie(checkbox.name);
     }
 }
-// -->
diff --git a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
index becd24fc4..cf56694d0 100644
--- a/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
+++ b/idp-conf-impl/src/main/resources/net/shibboleth/idp/module/views/user-prefs.vm
@@ -13,8 +13,8 @@
 #set ($onLoad = "load('spnego')")
 #set ($onClick = "check(this)")
 $response.addHeader("Content-Security-Policy", "script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)','sha256-$cspDigester.apply($onClick)'")
-## Hash of user-prefs.js (being injected inline below).
-$response.addHeader("Content-Security-Policy", "script-src-elem 'unsafe-hashes' 'sha256-mXQMhpzvwZ/f5iKzcm/iFe50L/0b7cNjsvcFVu/PMTg='")
+#set ($nonce = $cspNonce.generateIdentifier())
+$response.addHeader("Content-Security-Policy", "script-src-elem 'nonce-$nonce'")
 <!DOCTYPE html>
 <html>
     <head>
@@ -23,7 +23,7 @@ $response.addHeader("Content-Security-Policy", "script-src-elem 'unsafe-hashes'
         <meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1">
         <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=5.0">
         <link rel="stylesheet" type="text/css" href="$request.getContextPath()#springMessageText("idp.css", "/css/placeholder.css")">
-        <script language="Javascript">#parse("user-prefs.js")</script>
+        <script nonce="$nonce"><!-- #parse("user-prefs.js") // --></script>
     </head>
 
    <body onLoad="$onLoad">

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.
