Branch selector disappear immediately (Uncaught EvalError: 'unsafe-eval' is not an allowed)

[CleyFaye]

Description

Hi,

When browsing a repository on gitea, the branch selection widget disappear as soon as the page complete loading.
Disabling JavaScript leave the widget visible.

I'm not sure if any config would be relevant to help diagnose the issue. Although it seems to be fixed in the test instance of gitea, it is currently not available as docker images so the issue persist.

Screenshots

With JavaScript disabled, the widget is visible:

With JavaScript enabled:

Gitea Version

1.16.8 built with GNU Make 4.3, go1.18.2 : bindata, timetzdata, sqlite, sqlite_unlock_notify

Can you reproduce the bug on the Gitea demo site?

No

Operating System

Linux

Browser Version

Chrome 101.0.4951.64

[wxiaoguang]

I know some other users also met the similar problem, I forget the details but in the end it's not a bug.

Could you try to:

1. Check if there is any error message in your browser's console log?
2. Are you using customized templates? Remove customized templates.
3. Visit the page with Private/Incognito Window?

[CleyFaye]

Ah, you found it, somehow.
I initially missed a Content Security Policy error. We indeed have some CSP set which exclude eval() and the like in JavaScript. Relaxing these policies by adding "unsafe-eval" does fix the issue.

(it also match the behavior of the test gitea instance, since there is no CSP there)

Maybe not depending on "eval()" code would be a good thing in the future, this does fix the issue in that particular case.

[wxiaoguang]

Hmm .... some frameworks need eval, there is no eval in Gitea's JS code (web_src/js).

[techknowlogick]

@CleyFaye are you also able to post the CSP headers that you are applying?

[CleyFaye]

Yes. I trimmed it down to what seems to be the minimum extra stuff for gitea to operate:

Content-Security-Policy: default-src 'self'; img-src 'self' *.gravatar.com; media-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'none'; connect-src 'self'; manifest-src 'self' data:

Removing either "unsafe-inline" or "unsafe-eval" from script-src results in errors in the console.

[silverwind]

Might be worth searching the dependency code for eval use and report those to to them.

[wULLSnpAXbWZGYDYyhWTKKspEQoaYxXyhoisqHf]

Yes. I trimmed it down to what seems to be the minimum extra stuff for gitea to operate:

Content-Security-Policy: default-src 'self'; img-src 'self' *.gravatar.com; media-src 'self'; style-src 'self' 'unsafe-inline'; font-src 'self' data:; script-src 'self' 'unsafe-inline' 'unsafe-eval'; frame-ancestors 'none'; connect-src 'self'; manifest-src 'self' data:

Removing either "unsafe-inline" or "unsafe-eval" from script-src results in errors in the console.

confirming that running Gitea with CSP headers not containing 'unsafe-inline' 'unsafe-eval' (still) results in errors.
as a matter of fact, I have been trying to tweak CSP for Gitea for quite some time now but to this day I, too, have been unable to get rid of the Evil Twin Tandem (unsafe-{inline,eval}) and retain a fully functional instance.

additionally, that practically means all instances (even with CSP configured as tightly as possible to still have working buttons etc.) are vulnerable to XSS in one form or another [1], which doesn't exactly cheer me up.

as was (in part) previously mentioned, the solution would be:

• a): to get rid of the code (or frameworks having code) that utilises eval(), of which I assume there to be heaps (at least as I glimpsed when ploughing through DevTools Console's error messages, trying to get to the hashes of scripts/styles that were blocked by CSP and would need to be added to allowlist)

OR

• b): to begin (perhaps optionally, for starters) setting CSP headers with pre-computed hashes or nonces for scripts/stylesheets and pages with inline scripts/styles Gitea-side, eventually enabling the user (instance admin) to tweak/add supplementary directives in the config (app.ini) as needed.

while I feel either of the proposed solutions would be greatly improving the security grounding of Gitea as a widely-deployed internet-facing service, I am aware it would require quite some time and energy to evaluate, implement and review.

perhaps it is still better than nothing to at least start a discussion.

just my two cents.

ref:
[1]: https://web.dev/csp/#eval-too

[silverwind]

unsafe-eval: Problem is really we can't really force our third-party JS dependencies to not use eval other than switching to different dependencies.
unsafe-inline: For script-src, we should be able to fix all cases of inline JS, there are certainly a few left. For style-src a exception will need to be added regardless as many mechanisms rely on inline styles, and I also see no inherent problem with those.