CSP blocked loading resource at inline script-src error in Firefox.

[artfulrobot]

Steps to reproduce

Load the main nextcloud page. (i.e. All Files)

Expected behaviour

Page to load without errors in console.

Actual behaviour

Get this error in Firefox's web console: (Firefox 64 https://whatismybrowser.com/w/DSQGWHK)

Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").

Nb. this does not happen in Chromium.

Server configuration detail

Operating system: Linux 4.9.0-8-amd64 #1 SMP Debian 4.9.110-3+deb9u6 (2018-10-08) x86_64

Webserver: Apache/2.4.25 (Debian) (apache2handler)

Database: mysql 10.1.26

PHP version:

7.0.30-0+deb9u1
Modules loaded: Core, date, libxml, openssl, pcre, zlib, filter, hash, Reflection, SPL, session, standard, apache2handler, mysqlnd, PDO, xml, bz2, calendar, ctype, curl, dom, mbstring, fileinfo, ftp, gd, gettext, iconv, json, exif, mcrypt, mysqli, pdo_mysql, Phar, posix, readline, shmop, SimpleXML, sockets, sysvmsg, sysvsem, sysvshm, tokenizer, wddx, xmlreader, xmlwriter, xsl, zip, Zend OPcache, xdebug

Nextcloud version: 14.0.4 - 14.0.4.2

Updated from an older Nextcloud/ownCloud or fresh install:

Where did you install Nextcloud from: unknown

Signing status

Array
(
)

List of activated apps

Enabled:
 - accessibility: 1.0.1
 - activity: 2.7.0
 - bookmarks: 0.14.2
 - bookmarks_fulltextsearch: 1.0.0
 - bruteforcesettings: 1.2.0
 - cloud_federation_api: 0.0.1
 - comments: 1.4.0
 - contacts: 2.1.7
 - dav: 1.6.0
 - deck: 0.5.0
 - federatedfilesharing: 1.4.0
 - federation: 1.4.0
 - files: 1.9.0
 - files_external: 1.5.0
 - files_linkeditor: 1.0.7
 - files_markdown: 2.0.5
 - files_mindmap: 0.0.10
 - files_pdfviewer: 1.3.2
 - files_rightclick: 0.8.4
 - files_sharing: 1.6.2
 - files_texteditor: 2.6.0
 - files_trashbin: 1.4.1
 - files_versions: 1.7.1
 - files_videoplayer: 1.3.0
 - firstrunwizard: 2.3.0
 - fulltextsearch: 1.1.0
 - gallery: 18.1.0
 - issuetemplate: 0.4.0
 - logreader: 2.0.0
 - lookup_server_connector: 1.2.0
 - mail: 0.11.0
 - news: 13.0.3
 - nextcloud_announcements: 1.3.0
 - notes: 2.5.0
 - notifications: 2.2.1
 - oauth2: 1.2.1
 - ownpad: 0.6.8
 - password_policy: 1.4.0
 - polls: 0.8.3
 - provisioning_api: 1.4.0
 - serverinfo: 1.4.0
 - sharebymail: 1.4.0
 - spreed: 4.0.1
 - support: 1.0.0
 - survey_client: 1.2.0
 - systemtags: 1.4.0
 - tasks: 0.9.8
 - twofactor_backupcodes: 1.3.1
 - updatenotification: 1.4.1
 - workflowengine: 1.4.0
Disabled:
 - admin_audit
 - encryption
 - theming
 - user_external
 - user_ldap

Configuration (config/config.php)

{
    "instanceid": "***REMOVED SENSITIVE VALUE***",
    "passwordsalt": "***REMOVED SENSITIVE VALUE***",
    "secret": "***REMOVED SENSITIVE VALUE***",
    "trusted_domains": [
        "**removed**"
    ],
    "datadirectory": "***REMOVED SENSITIVE VALUE***",
    "overwrite.cli.url": "https:\/\/**removed**\/nextcloud",
    "dbtype": "mysql",
    "version": "14.0.4.2",
    "dbname": "***REMOVED SENSITIVE VALUE***",
    "dbhost": "***REMOVED SENSITIVE VALUE***",
    "dbport": "",
    "dbtableprefix": "oc_",
    "mysql.utf8mb4": true,
    "dbuser": "***REMOVED SENSITIVE VALUE***",
    "dbpassword": "***REMOVED SENSITIVE VALUE***",
    "installed": true,
    "htaccess.RewriteBase": "\/nextcloud",
    "overwritewebroot": "\/nextcloud",
    "theme": "",
    "loglevel": 2,
    "maintenance": false,
    "updater.release.channel": "stable",
    "mail_from_address": "***REMOVED SENSITIVE VALUE***",
    "mail_smtpmode": "smtp",
    "mail_domain": "***REMOVED SENSITIVE VALUE***",
    "updater.secret": "***REMOVED SENSITIVE VALUE***"
}

Are you using external storage, if yes which one: local/smb/sftp/...

Are you using encryption:

Are you using an external user-backend, if yes which one: LDAP/ActiveDirectory/Webdav/...

Client configuration

Browser: Mozilla/5.0 (X11; Linux x86_64; rv:64.0) Gecko/20100101 Firefox/64.0

Operating system: Ubuntu 18.04

Logs

Browser log

Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").
files:1:1
JQMIGRATE: Migrate is installed, version 1.4.0 core.js:7:542
window.controllers/Controllers is deprecated. Do not use it for UA detection. merged.js:2176 

Nextcloud log

N/A?

Browser log

Content Security Policy: Directive ‘child-src’ has been deprecated. Please use directive ‘worker-src’ to control workers, or directive ‘frame-src’ to control frames respectively.
Content Security Policy: The page's settings blocked the loading of a resource at inline ("script-src").
files:1:1
JQMIGRATE: Migrate is installed, version 1.4.0 core.js:7:542
window.controllers/Controllers is deprecated. Do not use it for UA detection. merged.js:2176

[nextcloud-bot]

GitMate.io thinks possibly related issues are #8358 (CSP is blocking font in data:), #2791 (CSP blocks path from server?), #11035 (CSP child-src is deprecated), #10489 (Warnings and errors in Firefox console), and #10254 (File Download CSP Error).

[artfulrobot]

Dear bot, this does look like the first of the 2 errors shown in #10489 but that bug was closed off for an earlier version. I'm seeing the error in latest stable 14.0.4. I'm running nextcloud in a directory https://example.com/nextcloud/ (if that makes a difference).

I'm not concerned about the warnings, but the error suggests, well, an error!

[ChristophWurst]

What specific resource was blocked? Is it possible this is one of your extensions that tries to inject a script? I'm pretty sure this is the case because I see that too occasionally (e.g. with the Vue dev tools).

[artfulrobot]

@ChristophWurst Hmmm, I don't know, I posted all the info there was from the console log.

I have been through my apps, disabling them one by one and reloading the main page after disabling to check for the error. The error persisted throughout. Here's the full list of apps I disabled:

• notes
• accessibility
• activity
• bookmarks
• brute force
• comments
• contacts
• deck
• deleted files
• external storage
• federation
• file sharing
• files right click
• first run wizard
• full text search
• full text search bookmarks
• gallery
• issue template
• link editor
• log reader
• mail
• markdown editor
• mind map
• monitoring
• news
• nextcloud announcements
• notifications
• ownpad
• password policy
• pdf viewer
• polls
• share by mail
• support
• talk
• tasks
• text editor
• update notification
• versions
• video player

[ChristophWurst]

Okay, sorry for not being more specific. With extension I don't mean Nextcloud apps but browser extensions. Could you try with a fresh profile on Firefox or another browser like Chrome?

[artfulrobot]

Dang, you're right! With a fresh profile it doesn't happen. OK, this is clearly a local issue, sorry for taking up your time and many thanks for your work and support.

[ChristophWurst]

No worries ✌️

[artfulrobot]

For the sake of other googlers, it was the Privacy Badger extension that was generating the errors I saw.

[xaverfleer]

I think this is still a bug.

While the behavior is correct (JavaScript gets blocked by the addon), the error message is incorrect.
Expected Error Message: none
Actual Error Message: "Content Security Policy: The page’s settings blocked the loading of a resource at inline (“script-src”)."

[xaverfleer]

For the sake of other googlers, I oberved the same behavior with uMatrix addon.

[deoakshay]

I am still getting this error in the console, when trying to login to my gmail account