The discussion revolves around a theme component issue with an invalid “extend content security policy” value. michaeld reported that after updating to Discourse 3.4, their forum crashed with an “Oops” error due to a space in the script-src value. The error was not logged, but an ActionDispatch::ContentSecurityPolicy::InvalidDirectiveError was thrown. kelv investigated and found that the issue stemmed from a backported Rails security patch. A fix has been merged into the main, tests-passed, and stable branches via https://github.com/discourse/discourse/pull/31256. The fix filters out invalid values before building the Content Security Policy (CSP). Additionally, kelv explained that Safe mode did not work in this case because the issue was server-side, not client-side. The forum was previously on version 3.3.3 before the upgrade to 3.4.
Symptoms: after update to 3.4 the entire forum gave “Oops”. To make things worse, the logs stayed completely silent about this.
There was a theme component with “extend security policy” with value script-src: 'unsafe-eval' https://redacted.example.com
This crashed the entire forum because of an exception thrown in the action dispatcher, because there was a space in the value.
ActionDispatch::ContentSecurityPolicy::InvalidDirectiveError (Invalid Content Security Policy script-src: \"'unsafe-eval' https://redacted.example.com\". Directive values must not contain whitespace
or semicolons. Please use multiple arguments or other directive methods instead.)
Oh I forgot the most important thing. Safe mode did not work!!
This change in behaviour in handling CSP directives stemmed from a backported security patch in Rails - I touch on this in more detail in the PR. Discourse will now filter out such values before building the CSP.
Regarding Safe mode, as it only disables the JavaScript side of things, it wouldn’t have helped here since this data is processed server-side.
Discourse will now filter out such values before building the CSP.