Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Recaptcha Newsletter still uses inline scripts --> CSP warnings #337

Open
PachisPachis opened this issue Aug 13, 2024 · 1 comment
Open

Comments

@PachisPachis
Copy link

PachisPachis commented Aug 13, 2024

Preconditions (*)

1.Magento 2.4.7-p1
2.Default CSP config and whitelisting, no customizations. Please notice that default CSP policies blocks inline scripts in the checkout page.
3.Block for newsletter signup is shown in every page, including checkout. Block has a recaptcha validation.

Steps to reproduce (*)

1.Go to checkout.
2.Check browser console.
3.Notice the CSP warnings, attached screenshots in the following points.

Expected result (*)

  1. Module should use the rendertag function to deal with CSP default requirements, instead of inserting inline scripts. This would allow the script to be executed.
  2. No warnings should be shown by CSP policies in the browser console.

Actual result (*)

  1. Module is inserting inline scripts, detected by the CSP policies and generating unwanted warnings.
    image
    image

2.This is ocurring because of the following code:
image

Copy link

m2-assistant bot commented Aug 13, 2024

Hi @PachisPachis. Thank you for your report.
To speed up processing of this issue, make sure that you provided sufficient information.
Add a comment to assign the issue: @magento I am working on this


Join Magento Community Engineering Slack and ask your questions in #github channel.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant