paypal - '无法识别的内容安全策略指令 "reflected-xss'“与通过 chromedriver 生成的 PayPal 相关的错误

Question

自 2017 年 2 月 7 日(星期二)以来，由于某些原因，我们的持续集成测试失败了。

日志是通过https://github.com/SeleniumHQ/selenium/wiki/JsonWireProtocol#user-content-log-entry-json-object生成的

我用过 chromium 56.0.2924.87-1
Chrome 驱动程序 2.25

            [1] => Array
                (
                    [level] => SEVERE
                    [message] => https://www.sandbox.paypal.com/signin/inject/?stsRedirectUri=https%3A%2F%2Fwww.sandbox.paypal.com%2Fcheckoutnow%2F2&country.x=US&locale.x=en_US&returnUri=https%3A%2F%2Fwww.sandbox.paypal.com%2Fcheckoutnow%2F2&state=%3Fflow%3D1-P%26token%3DEC-5N74679848773161E%26useraction%3Dcommit&flowId=EC-5N74679848773161E&correlationId=c2516170ad8f6&flowContextData=d-T_d1elACFNiXhhfk4mio6Sh6WWFGmbOuXXROs9tP7rjABQARmehjUHUAKHiCRWrplD4ufu0B8WDTklRnEubKC-FY90pbF_e3y0S5fNbCjSjKyO8meAs7IsOC0&rememberMe=true - Unrecognized Content-Security-Policy directive 'reflected-xss'.

                    [timestamp] => 1486491911470
                )

            [2] => Array
                (
                    [level] => SEVERE
                    [message] => about:blank - Unrecognized Content-Security-Policy directive 'reflected-xss'.

                    [timestamp] => 1486491911554
                )

            [3] => Array
                (
                    [level] => SEVERE
                    [message] => about:blank - Unrecognized Content-Security-Policy directive 'reflected-xss'.

                    [timestamp] => 1486491911554
                )

            [4] => Array
                (
                    [level] => SEVERE
                    [message] => https://www.paypalobjects.com/web/res/069/67a0e1f4befbbcfdd8dc1dfb1f35b/js/app.js 47 Unrecognized Content-Security-Policy directive 'reflected-xss'.

                    [timestamp] => 1486491911899
                )

            [5] => Array
                (
                    [level] => SEVERE
                    [message] => https://www.paypalobjects.com/web/res/069/67a0e1f4befbbcfdd8dc1dfb1f35b/js/app.js 47 Unrecognized Content-Security-Policy directive 'reflected-xss'.

                    [timestamp] => 1486491911899
                )

我可以解决我这边的问题吗？

Answer 1

Chrome 已在 56 及更新版本中弃用此 CSP

https://www.chromestatus.com/feature/5769374145183744

正确应用 header 取决于您实际访问的站点，因此您无法通过客户端测试控制这些内容。