I enabled the report-only mode and the server immediately threw an error and my website went down, so I had to recover by renaming the plugin.
I’m using NGINX. Is this plugin only for use with Apache servers?
]]>Hi, a client’s site is using ACF to add an image as a background image to a banner (banner on top of page) through the inline “style”. That was blocked by the CSP, so I created a <style>…</style> tag and put the background image there. This was still banned but I was able to whitelist through the plugin inline menus.
Issue: if the client is changing the image (which they often do), it looks like that tag block gets banned and has to manually be whitelisted again which is a big hassle and not preferred. I’ve been trying to figure out how to add a nonce or hash to this so it’s auto-accepted no matter what image the client chooses, but I’m having trouble with this.
Any idea? From what I understand, the plugin should be able to do that. I also tried creating and adding a nonce through php but the nonce attribute is always empty. Not really sure where to go from here
]]>I’m having problems getting this one to work:
no-unsafe-inline-fix-style.min.js?ver=1.2.2:2 [Report Only] Refused to apply inline style because it violates the following Content Security Policy directive: “style-src https://pro.fontawesome.com ‘nonce-f729f65c7d6625f00e4266825df72b094d37e64c6e7ad38d8590bc6deab4c949’ ‘report-sample'”. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-N0psPaXG96mUcdWtcusjcwUFwppzPflJqwG7HJYmREw=’), or a nonce (‘nonce-…’) is required to enable inline execution.
Element.insertBefore @ no-unsafe-inline-fix-style.min.js?ver=1.2.2:2
(anonymous) @ 98c73cfb02.js:2
(anonymous) @ 98c73cfb02.js:2Understand this er
I can see it in source with integrity=”sha256-3rZtO7fq9/9d7P…” crossorigin=”anonymous” nonce=”b6accd…”
It’s whitelisted, I tried hash, rehash and even deleting and then white listing, but still not working.
]]>We are report only now, but it looks like the plugin is adding this x-content-security-policy: default-src ‘self’; img-src *; media-src * data:; to the header. Yet, we do have some img-src specified. Do the * get removed when we go to enforcing?
Aren’t the X- older style anyhow?
]]>I was having an issue where enabling the CSP policy was generating CORs errors for a third party script. I noticed that the plugin adds crossorigin='anonymous' to script resources but first checks a list of domains that should be excluded.
This list is:
$not_sri_sources = array(
'fonts.googleapis', // https://github.com/google/fonts/issues/473 .
'consent.cookiebot.com', // https://support.cookiebot.com/hc/en-us/community/posts/360029353353-Subresource-Integrity-SRI-and-Cookiebot .
'cookie-cdn.cookiepro.com', // https://www.ads-software.com/support/topic/cookie-pro-script-gets-blocked-from-time-to-time/ .
);Since there’s no filter for this array, I have to manually modify the plugin to add the third party resource we are trying to use. Is there any chance that you can add a filter for this (or something in the wp-admin) so that we can safely add to this list?
I’m new to using this plugin so let me know if I should take a different approach.
]]>Hi there. The plugin ‘Settings’ tab allows us to disable enforcing CSP-policy in WordPress admin. This is great, because we only want to enforce CSP for visitors. However, when enabling ‘tag capturing’ in the plugin, the scripts, styles and events on admin pages are also captured. This generates large lists of scripts, styles and events which we then have to check and delete manually.
Therefore, it would be great if the ‘Enable tag capture’ option also allows us to choose between capturing only frontend or both (frontend+backend).
]]>Hi,
Post updating of the plugin to v1.2.2 . In spite of have turned on the CSP Protection, all the CSP Checkers like https://securityheaders.com/
https://observatory.mozilla.org/
https://csp-evaluator.withgoogle.com/
https://csper.io/evaluator
gives out error “Cannot fetch CSP headers!” or “unable to evaluate url: no policies found at URL”
]]>Dear,
I have a problem in website
(Fatal error: Uncaught Rubix\ML\Exceptions\RuntimeException: Estimator has not been trained. in /public_html/wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/src/Classifiers/KNearestNeighbors.php:208 Stack trace: #0 /public_html/wp-content/plugins/no-unsafe-inline/src/Nunil_Manipulate_DOM.php(985): Rubix\ML\Classifiers\KNearestNeighbors->predict() #1 /public_html/wp-content/plugins/no-unsafe-inline/src/Nunil_Manipulate_DOM.php(416): NUNIL\Nunil_Manipulate_DOM->check_cluster_whitelist() #2 /public_html/wp-content/plugins/no-unsafe-inline/src/Nunil_Manipulate_DOM.php(302): NUNIL\Nunil_Manipulate_DOM->allow_inline() #3 /public_html/wp-content/plugins/no-unsafe-inline/src/Nunil_Manipulate_DOM.php(273): NUNIL\Nunil_Manipulate_DOM->manipulate_inline_scripts() #4 /public_html/wp-content/plugins/no-unsafe-inline/public/class-no-unsafe-inline-public.php(201): NUNIL\Nunil_Manipulate_DOM->get_local_csp() #5 /public_html/wp-includes/class-wp-hook.php(324): No_Unsafe_Inline_Public->filter_final_output() #6 /public_html/wp-includes/plugin.php(205): WP_Hook->apply_filters() #7 /public_html/wp-content/mu-plugins/no-unsafe-inline-output-buffering.php(46): apply_filters() #8 /public_html/wp-includes/class-wp-hook.php(324): {closure}() #9 /public_html/wp-includes/class-wp-hook.php(348): WP_Hook->apply_filters() #10 /public_html/wp-includes/plugin.php(517): WP_Hook->do_action() #11 /public_html/wp-includes/load.php(1280): do_action() #12 [internal function]: shutdown_action_hook() #13 {main} thrown in /public_html/wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/src/Classifiers/KNearestNeighbors.php on line 208)
and when deactivate plugin website work good. can you support me ?
]]>Hello, in the plugin dependencies, the “rubix/ml: ^2.0” library is used. In the mkdocs.yml file of this version there is a vulnerability related to the polyfill library.
From Rubix, they have updated the dependencies and polyfill.io is no longer needed in the dependencies.
I would like to know if it is possible to update Rubix to a major version, where it has the patch for this vulnerability.
Thanks in advance
]]>I am hoping to be able to use this plugin with a site hosted on WPVIP.
The issue I have encountered however is due to the file storage used, this is throwing an error by the trainer when it attempts to store an rbx file.
ie:
PHP message: PHP Fatal error: Uncaught Rubix\ML\Exceptions\RuntimeException: Could not write to the filesystem. in /var/www/wp-content/plugins/no-unsafe-inline/vendor/rubix/ml/src/Persisters/Filesystem.php:111
As the WPVIP hosting has locked down the uploads directory functionality here, I was wondering if it may be feasible to use the DB as an option, or perhaps otherwise limit this feature?
Really great work on this plugin.
Thank you-
I have this error after activating the plugin and following all the steps, I have the doubt if in Base script-src sources, I have to include ‘nonce-variable’. Thanks in advance
gtm.js?id=GTM-PZZGZ9D:141 Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘self’ https: https://cdn.lawwing.com……… ‘nonce-7db18198bf1eac9b8321d21de6930997346f709fe33e8fb57ee2f02f9bb1f73e'”. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-MZCQKjztw6vXJm2oO8xEkIyWYR7qA/4Ov+GBK+5f4Eo=’), or a nonce (‘nonce-…’) is required to enable inline execution.
]]>I’ve been through the instruction steps a few times, and followed closely. In report-only mode, I am still getting many errors of scripts and styles not loading. Inline styles and scripts are being blocked because they require either?unsafe-inline (which we don’t want), a valid nonce, or a hash. I haven’t changed much of the default settings, but I’m wondering if I should be using hashes instead of nonces? Or if using nonces, do they need to be manually added to each script?
From what I can tell, the nonce is not being applied to the scripts or styles so they’re not being allowed.
Do you have any suggestions based on this? Thank you.
I tried turning on db logging, but when I go to log tab, I don’t see any entries. I changed to php error log and that also does not work. It is set to debug.
In my php error log I do have this many times:
[01-Jul-2024 14:40:00 UTC] PHP Warning: Undefined array key “blocked-uri” in D:\usdev_htdocs\wp-content\plugins\no-unsafe-inline\src\Nunil_Capture_CSP_Violations.php on line 80
[01-Jul-2024 14:40:00 UTC] PHP Warning: Undefined array key “document-uri” in D:\usdev_htdocs\wp-content\plugins\no-unsafe-inline\src\Nunil_Capture_CSP_Violations.php on line 82
I cannot figure out how to fix this:
[Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: “script-src ‘self’ https: https://cdnjs.cloudflare.com https://script.crazyegg.com ‘nonce-2214f199ebd499f0d215-shortened’ ‘report-sample'”. Either the ‘unsafe-inline’ keyword, a hash (‘sha256-d5AXR2g0ALC-shortened’), or a nonce (‘nonce-…’) is required to enable inline execution.
I whitelisted all the urls.
I have nonce enabled on style-src. Is there something else need to do?
This is happening on the default WordPress page of the site. It’s an internal site, so I don’t ahve a url.
]]>I have 400+ for my inline whitelist. It would be helpful if there was an option to have view pages expanded, so I don’t have to click each one.
]]>Hello!
I’m facing a strange issue when using the plugin. When I enable the checkbox “Test current csp policy” or “Enable csp protection” my HTML structure of my home page changes. This causes some javascript animation logic to break.
The javascript expects multiple sections below each other (not nested), each with the following classes: section fp-section fp-table.
For some reason when the checkbox is enabled all the sections except the first one are inside the first section… This causes my animations to break.
When I disable the testing checkbox or the plugin entirely the HTML structured is as it should be…
Does anybody know what might cause this issue?
Thanks for the assist!
]]>I was wandering if it was normal that in the Logs tab during the whole csp integration it said No items found. What is this tab supposed to be use for? I would have expect to see errors in this tab.
]]>There is a compatibility issue in the admin between GravityForm and No Unsafe-inline.
There are lots of JS errors and the form configuration no longer works in the Gravity Form admin pages when No unsafe-inline plugins is active. Even if everything is not active and there are no CSP rules in the WP admin (I confirmed that there are no CSP headers in the admin and the messages from the console does not mention that scripts were blocked)
Plugins:
Gravity Forms Version 2.8.9
Gravity Forms Multilingual Version 1.7.2
No unsafe-inline Version 1.2.1
WordPress 6.5.3
WPML Version 4.6.10
PHP 8.3
Once No unsafe-inline is activated, when we go to the admin, there are JS errors related to Gravity Form;
in wp-admin/index.php:Uncaught TypeError: gform.initializeOnLoaded is not a function
/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.8.9:1
in wp-admin/admin.php?page=gf_edit_formsUncaught TypeError: gform.initializeOnLoaded is not a function
/wp-content/plugins/gravityforms/js/gravityforms.min.js?ver=2.8.9:1
gravityforms.min.js:1:36959
Uncaught TypeError: gform.initializeOnLoaded is not a function
/wp-content/plugins/gravityforms/js/form_admin.min.js?ver=2.8.9:1
I tried to deactivate WPML or Gravity Forms Multilingual Version and it doesn’t help.
I tried the “no conflict mode” configuration in GravityForm and it doesn’t help.
Here’s the DOM in the admin of GF with no-unsafe-inline activated and deactivated:
https://paste.pics/c148e07e1d69ace6e5c09ede88a2ed02
https://paste.pics/d6e8b9b4a1549999ac2ab45bcc43dcf0
Hi Giuseppe,
on my website xmlrpc is active and running (when your plugin is deactivated).
Actviating the plugin, xmlrpc is not possible anymore and is not reported in the lists for whitelisting. So in principle, is it possible to use XMLRPC along with CSP active? Or what could be the reason this does not work here?
]]>Tank you for this fine peace of code! IT makes the things around CSP Header a lot easier.
All is working fine, but the dashboard lost all formatting and style. How to avoid this?
Best regards, Martin
]]>Hi,
Can I enable style-src base rules without creating a nonce?
I set style-src: 'self' 'unsafe-inline' https: in base rules and set style-src to none in settings “Select CSP mode for selected directives”. But a a nonce is still generated.
I’ve a div with background-image:
<div class="single-article-featured-image clearfix" style="background-image: url('/wp-content/uploads/2020/04/ordinateur-portable.jpg')">converted like that:
<div class="single-article-featured-image clearfix nunil-fly-6285a02504c26cc52191e7ffcee94a21299cf927779975b79b23ea83a4bacf4d">and background image are lost…
Any idea on how to fix that or a workaround??
]]>I get this error when visiting the site
‘PHP message: PHP Fatal error: Allowed memory size of 268435456 bytes exhausted (tried to allocate 20480 bytes) in plugins/no-unsafe-inline/vendor/rubix/ml/src/Datasets/Dataset.php on line 71’
This table is also very full: wp_nunil_inline_scripts (732.8 MiB)
Settings:
Enable tag capture = false
Enable csp = true
I see that there is a clean database action, but won’t it delete my clusters that i need for the inline scripts?
Experiencing an issue where the CSP stopped working all together. I updated a few plugins and went through steps 1-7 again. But it appears the CSP is no longer active on the site. Have you seen this issue happen before?
]]>Hi there
Thank you for creating what looks to be an incredibly useful plugin, that will be helping many folks with CSP-related headaches!
When I enable tag capture, our website crashes with a ‘HTTP ERROR 500’ message. From a lot of trial and error I established that removing this ‘show_content_snippet’ function from functions.php stops the crash happening, but it is pretty crucial to our site working properly. Do you have any ideas why this would be interfering with your plugin? Many thanks!
*/ function show_content_snippet( $post, $amount = 100 ) {
$post = (array)$post;
if( $post[‘post_excerpt’] !== ” ) {
echo apply_filters( ‘the_excerpt’, $post[‘post_excerpt’] );
}elseif( preg_match( ‘##is’, $post[‘post_content’] ) ) {
$moreSplit = explode( ”, apply_filters( ‘the_content’, $post[‘post_content’] ) );
echo $moreSplit[0];
}else{
echo ” . substr( strip_tags( $post[‘post_content’] ), 0, $amount ) . ‘…’;
}
}
Hi, first of all I would like to thank you for your plugin.
It seems to have everything I need.
However I would like to know where I can validate the generated CSP policy.
Well, when scanning the site on the Mozilla site (https://observatory.mozilla.org/), it appears that only the “upgrade-insecure-requests” option is there as the whole policy.
I would also like to know if you have considered the option of generating not nonces, but hashes for the styles.
Thanks in advance,
Regards
]]>This plugin seems like exactly what I need. I’ve been searching/trying to get rid of unsafe-inline and this plugin does everything I need. Except I can’t get rid of a few blocks. Mainly GTM. It seems like the nonce isn’t getting passed to the scripts that GTM loads.
There are also some inline styles still getting blocked, all coming from a hubspot script.
Any thoughts?
]]>From time to time the cookie pro script gets blocked again and this error message is shown:
Failed to find a valid digest in the ‘integrity’ attribute for resource.
When I look into the external scripts, the script is whitelisted. After rehashing the script starts working again. This is one part of the problem.
When the script starts working again, some actions of the script get blocked and an error in the plugin script gets shown:
no-unsafe-inline-fix-style.min.js?ver=1.1.2:2 Uncaught (in promise) TypeError: Cannot read properties of undefined (reading ‘toUpperCase’)
at no-unsafe-inline-fix-style.min.js?ver=1.1.2:2:524
I’ve been using this plugin to generate a very basic CSP for one of my client sites but since the latest update to Elementor the plugin now completely breaks the site! Even if the CSP function is switched off, just having the plugin active on the site completely breaks the layout! Is there anything I can do to fix this? Or is it an issue with Elementor?
]]>I make any thing and i don’t know where i can see CSP code to add it in htaccess file instead of old CSP code with unsafe line
]]>