csp bypass: remove nonce and hash directives (#78)

aureliendavid · Jun 19, 2023 · 910f4a4 · 910f4a4
1 parent 722c8e6
commit 910f4a4
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/background.js b/background.js
@@ -105,8 +105,14 @@ function patchCSP(csp) {
 
   let stylesrc = parsed_csp['style-src'] || [];
   if (! stylesrc.includes("'unsafe-inline'") ) {
-    stylesrc.push("'unsafe-inline'");
-    parsed_csp['style-src'] = stylesrc;
+    let newstylesrc = ["'unsafe-inline'"];
+
+    for (let src of stylesrc) {
+      if (!src.startsWith("'nonce") && !src.startsWith('sha'))
+        newstylesrc.push(src);
+    }
+
+    parsed_csp['style-src'] = newstylesrc;
 
     let new_csp = "";
 

diff --git a/manifest.json b/manifest.json
@@ -2,7 +2,7 @@
 
   "manifest_version": 2,
   "name": "RSSPreview",
-  "version": "3.20",
+  "version": "3.20.1",
   "author": "Aurelien David",
   "homepage_url": "https://github.com/aureliendavid/rsspreview",