英文:
Content Security Policy: Is data: applied to all items in the img-src source list?
问题
我正在尝试确定我的内容安全策略是否可以允许数据图像，例如base64编码的PNG（CSS代码），只允许 'self'，还是必须适用于列表中的所有来源。我找不到任何告诉我data:适用于什么的文档。我假设它适用于整个源列表。有人能确认吗？
img-src 'self' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://ajax.googleapis.com https://www.google-analytics.com https://www.googletagmanager.com data:;
我也在尝试确定这个img-src是否存在安全问题。感谢任何评论。
英文:
I've got a content security policy and I'm trying to determine if I can allow data images, such as base 64 encoded PNG's (CSS code), to just 'self' or if it must apply to all sources in the list. I can't find any documentation that tells me what data: is applied to. I assume then it's applied to the entire source list. Can anyone confirm?
img-src 'self' https://www.google.com/recaptcha/ https://www.gstatic.com/recaptcha/ https://ajax.googleapis.com https://www.google-analytics.com https://www.googletagmanager.com data:;
I'm also trying to determine if there is any security concerns with this img-src. Thank you for any comments.
答案1
得分: 1
'self' 和 data: 都是值。它们彼此不适用，都适用于指令（在这种情况下是 img-src）。
英文:
'self' and data: are both values. Neither apply to each other. Both apply to directives (in this case img-src).
答案2
得分: 1
Images are typically not a security threat by themselves, particularly when they are loaded as data: in an allowlisted CSS file. It could be a way to smuggle a script, but images don't carry the same risk.
Images could potentially carry malicious content, but the main reason to restrict img-src would be to prevent data exfiltration in image URLs. This would not apply to the data scheme.
英文:
Images are typically not a security threat by themselves, particularly when they are loaded as data: in an allowlisted CSS file. It could be a way to smuggle a script, but images don't carry the same risk.
Images could potentially carry malicious content, but the main reason to restrict img-src would be to prevent data exfiltration in image URLs. This would not apply to the data scheme.
通过集体智慧和协作来改善编程学习和解决问题的方式。致力于成为全球开发者共同参与的知识库，让每个人都能够通过互相帮助和分享经验来进步。
评论