Mailing-List: contact users-help@httpd.apache.org; run by ezmlm
Precedence: bulk
Reply-To: users@httpd.apache.org
Reply-To: lspeciale@gmail.com
To: users@httpd.apache.org
References: <4a513065-4a8c-99c3-754c-f2c8e7a28339@gmail.com>
 <3fe3858d-7070-c49b-259d-d9eed52c5ef6@apache.org>
 <3f9021f2-0908-db16-ae88-ffcca271f9f4@gmail.com>
 <af5af378-c8f0-6486-54e5-572c34716d16@apache.org>
From: Luis Speciale <lspeciale@gmail.com>
Message-ID: <e8872030-465c-ae04-87e3-43667b7d6090@gmail.com>
Date: Thu, 7 Sep 2017 20:54:07 +0200
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:52.0)
 Gecko/20100101 Thunderbird/52.3.0
MIME-Version: 1.0
In-Reply-To: <af5af378-c8f0-6486-54e5-572c34716d16@apache.org>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: fr
Content-Transfer-Encoding: 8bit
Subject: Re: [users@httpd] CSP nonces in apache
archived-at: Thu, 07 Sep 2017 18:54:18 -0000

Le 07/09/2017 à 20:36, Daniel Gruno a écrit :
> On 09/07/2017 08:30 PM, Luis Speciale wrote:
>> Le 07/09/2017 à 19:53, Daniel Gruno a écrit :
>>
>> Thank you for your answer.
>>
>>> Quick spot-check says you should probably change '.)*)' to ').*)'
>>
>> I tried this but it doesn't seem to work.
>>
>>> Also, the env vars need to be ${}'ed.
>>
>> Ok,  I got it.
>>
>>> Assuming you want to inject nonce-foo into all non-external scripts, I
>>> would shorten it to something like:
>>>
>>> s|<(style|script)\s*((?!src=).*)>|<$1 nonce-${numbnonce} $2>|
>>
>> When i do like you said, I have an error
>> Bad Substitute flag, only s///[infq] are supported
>> I imagine it's because the extra pipe.
>> But even without it
>> Substitute "s|<(style)\s*((?!src=).*)>|<$1 nonce-${numbnonce} $2>|i"
>> I have no substitution at all.
> 
> Try:
> 
> Substitute "s/<(style|script)((?!\s*src=).*)>/<$1 nonce-${numbnonce} $2>/i"

Now it substitutes <script> with <script nonce-%{unique_id}e="">
It ignores the value of numbnonce (%{UNIQUE_ID}e) and writes it 
litterally, even if in the headers this variable appears ok.
When I look the headers it has the correct value
'nonce-WbGTF8CoABAAADn5XWYAAAAP'

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@httpd.apache.org
For additional commands, e-mail: users-help@httpd.apache.org