christophrumpel / christoph-rumpel.com Goto Github PK

Hello, I found your blog post as it was on the first page of google result for "CSP nonce caching", which I was looking for solutions to.

Just wanted to point out that as written, the nonce isn't providing protection; the preg_replace call adds the correct nonce to any script tag with a nonce attribute, even if the original nonce was incorrect. If an attacker was able to inject <script nonce="">doAHack()</script> into your site, the middleware would add the correct nonce and the browser would run it.

Perhaps there could be an additional step where a regex extracts the correct nonce from the original header and only replaces instances of that with the new nonce?

Hello, there!

As part of the university research we are currently doing regarding the security of Github Actions, we noticed that one or many of the workflows that are part of this repository are referencing vulnerable versions of the third-party actions. As part of a disclosure process, we decided to open issues to notify GitHub Community.

Please note that there are could be some false positives in our methodology, thus not all of the open issues could be valid. If that is the case, please let us know, so that we can improve on our approach. You can contact me directly using an email: ikoishy [at] ncsu.edu

Thanks in advance

1. The workflow run-tests.yml is referencing action shivammathur/setup-php using references v1. However this reference is missing the commit 7163319 which may contain fix to the vulnerability.

The vulnerability fix that is missing by actions' versions could be related to:
(1) CVE fix
(2) upgrade of vulnerable dependency
(3) fix to secret leak and others.
Please consider updating the reference to the action.

If you end up updating the reference, please let us know. We need the stats for the paper :-)