security - 如果允许 unsafe-inline，CSP 会保护我们什么

Question

目前我正在定义如下内容安全策略(CSP)；

Header set Content-Security-Policy: "default-src 'self' data:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"

考虑到上面的 CSP 定义，我对内联 JavaScript 有一个挑战，因为它可以随时被覆盖。
unsafe-inline有什么用如果它实际上不保护？

Answer 1

unsafe-inline在当前站点中移动或重写内联代码时使用该选项不是一个直接的选项，但您仍想使用 CSP 来控制其他方面(例如 object-src，防止注入(inject)第三方 js 等)。你是对的 unsafe-inline不提供太多安全性，因为它允许执行不安全的页内脚本和事件处理程序。
谷歌的 CSP Evaluator是一个很好的工具，可以确定您的政策是否强大。unsafe-inline 的用例使用的选项可以在 Google 的 Web Developer documentation on Content Security Policy 中找到:

A wedding-ring discussion forum admin wants to ensure that all resources are only loaded via secure channels, but doesn't really write much code; rewriting large chunks of the third-party forum software that's filled to the brim with inline script and style is beyond his abilities. The following policy would be effective:

Content-Security-Policy: default-src https:; script-src https: 'unsafe-inline'; style-src https: 'unsafe-inline'

Even though https: is specified in default-src, the script and style directives don't automatically inherit that source. Each directive completely overwrites the default for that specific type of resource.