How to set Content Security Policy in Windows Univ

2020-02-13 13:34发布

站内问答 / JavaScript
1985 3 4

I don't even know if that's what I need, but after several days of this MSDN Forum post with no answers at all I thought I'd give a shot in SO.

My problem: I have many Windows 8.1 and Windows Phone 8.1 HTML/Javascripts apps that have a little <script> sentence in the <head> of every html page. I started migrating my apps to Windows 10 as a single Universal Windows app but I get the following error:

CSP14312: Resource violated directive 'script-src ms-appx: data: 'unsafe-eval'' in Host Defined Policy: inline script. Resource will be blocked

and of course, nothing gets executed... am I missing anything?

edit: To repro just create a blank Windows Universal app with VS2015 RC and add

<script>
    console.log('hello');
</script>

right before the head tag closes

3条回答
趁早两清
2楼-- · 2020-02-13 14:17

Rob has it right, by default you can't have inline script in ms-appx:/// protocol. This is the default protocol for an application and has a default CSP policy that doesn't allow inline script.

If you really wish to use inline script you can navigate to the content via ms-appx-web:/// protocol where there is no default CSP policy.

The one note is that you do not have access to some capabilities in this protocol.

The only difference I have beyond what Rob said is that you most likely want to set the Application Content URI Rule (ACUR) like this

<uap:ApplicationContentUriRules>
   <uap:Rule Type="include" Match ="ms-appx-web:///" WindowsRuntimeAccess="all"/>
</uap:ApplicationContentUriRules>

To navigate to your content you can set the StartPage in the manifest to ms-appx-web:///default.html

查看更多
0人赞 添加讨论(0) 举报
够拽才男人
3楼-- · 2020-02-13 14:21

I assume that's not your real use case, but overall it depends on the specific script whether it will work in the local or web context. See Features and restrictions by context for an overview. If you can pull the script into a local JS file instead of calling it from the head then I would recommend that rather than fiddling with the app's security contexts.

Your console.log example works if it runs from the package (as you note) or if it runs in the web context. You can force the entire app to run in the web context by changing the start page to ms-appx-web:///default.html in the manifest.

However, since the app's now in the restricted web context it won't have access to all of the Windows Runtime. You can open that up by adding the following to the Application section in your manifest:

<uap:ApplicationContentUriRules>
   <uap:Rule Type="include" Match ="ms-appx-web:///" WindowsRuntimeAccess="allowForWebOnly"/>
</uap:ApplicationContentUriRules>

You'll need to open the manifest in a code editor rather than in the manifest editor to modify this section.

For more on the error see the Edge Console error and status codes documentation

查看更多
0人赞 添加讨论(0) 举报
我欲成王，谁敢阻挡
4楼-- · 2020-02-13 14:27

Were you able to resolve this issue? I do apps and game development using the Enyo framework and encountered the same issue. I was able to resolve it by entering the lines that I normally enter on the tag on the default.js file on this section:

        if (args.detail.previousExecutionState !== activation.ApplicationExecutionState.terminated) {
            // TODO: This application has been newly launched. Initialize your application here.
            initializemyapp();
            console.log("starting");
        } else {
            // TODO: This application was suspended and then terminated.
            // To create a smooth user experience, restore application state here so that it looks like the app never stopped running.
        }

Maybe it is a little to late, but hope this helps.

查看更多
0人赞 添加讨论(0) 举报
登录 后发表回答
相关问题
查看全部
相关文章
查看全部
收藏的人(4)