[j13n]

This is the second post I’ve seen praising Datastar in the last 24 hours, and once again no mention of the requirement to punch a gaping hole in one’s Content-Security-Policy.

If this is the framework of the future, cyber criminals are going to have a bright future!

[sudodevnull]

That's the nature of anything that does this kind of work. React, Svelte, Solid. Alpine has a CSP version but it does so little that I recommend you just accept being a Web1 MPA basic site.

I have ideas around ways around this but it's a per language template middleware.

[jazoom]

Alpine CSP version works fine. You just can't write JS code in strings, which one may wish to avoid anyway.

I also didn't have a problem with CSP and HTMX.

Nor with SvelteKit.

I'm not sure why you think these are all equivalent to DataStar's hard requirement on unsafe-eval.

FYI, this is the reason I didn't try out DataStar.

[pie_flavor]

Svelte only requires a CSP hole in its default config as a standalone library; SvelteKit does proper CSP by default, and if you're not using SvelteKit you can build CSP handling into whatever you are using instead. I assume the others are the same way.

[tauroid]

Could you avoid eval by having a CSP mode that forces reactive expressions to only allow functions users have registered with datastar in a lookup table?

[dpc_01234]

Is there anything I could read detailed explanation of issue, in particular w.r.t datastar?

[andersmurphy]

Please don't cargo cult CSP without understanding it.

unsafe-eval constrained to function constructors without inline scripts is only a concern if you are rendering user submitted HTML (most common case I see is markdown). Regardless of your CSP configuration you should be sanitizing that user submitted HTML anyway.

[max_]

How does this compare to HTMX (security wise)?

[sudodevnull]

Same, you control your signals and fragments. So you are responsible for proper escaping and thoughtful design.

[j13n]

You can disable all use of eval with htmx. The tradeoff is one has to write a bit more JavaScript.

https://news.ycombinator.com/item?id=43650921

[sudodevnull]

I have thoughts about a fully compliant CSP middleware, problem is it's per language so I'd probably only make for Go (maybe PHP & TS)

[geoka9]

Hashes or nonces?

[sudodevnull]

Hashed script content

[geoka9]

Thank you for doing this. Is it possible to follow the work somewhere?

[nchmy]

could you please elaborate on this?