标题：*
140 字

TAG标签：（用空格隔开）
30 字

恢复历史版本：

HTML转MD HTML转MD2

<span style="color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; background-color: rgb(249, 249, 249);">跨域脚本攻击 XSS 是最常见、危害最大的网页安全漏洞，本文详细介绍如何使用 CSP 防止 XSS 攻击。<span style="color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; background-color: rgb(249, 249, 249);"><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px; text-align: center;"><img src="/ueditor/php/upload/image/20170916/1505494568728380.png" alt="" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; cursor: pointer;"/><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">为了防止它们，要采取很多编程措施，非常麻烦。很多人提出，能不能根本上解决问题，浏览器自动禁止外部注入恶意脚本？这就是&quot;网页安全政策&quot;（Content Security Policy，缩写 CSP）的来历。本文详细介绍如何使用 CSP 防止 XSS 攻击。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px; text-align: center;"><img src="/ueditor/php/upload/image/20170916/1505494568672803.jpg" alt="" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; cursor: pointer;"/><h2 id="1" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 30px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">一、简介</h2><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">CSP 的实质就是白名单制度，开发者明确告诉客户端，哪些外部资源可以加载和执行，等同于提供白名单。它的实现和执行全部由浏览器完成，开发者只需提供配置。CSP 大大增强了网页的安全性。攻击者即使发现了漏洞，也没法注入脚本，除非还控制了一台列入了白名单的可信主机。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">两种方法可以启用 CSP。一种是通过 HTTP 头信息的Content-Security-Policy的字段。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px; text-align: center;"><img src="/ueditor/php/upload/image/20170916/1505494569978400.jpg" alt="" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; cursor: pointer;"/><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px; text-align: center;"> <p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); white-space: normal; background-color: rgb(255, 255, 255); border: 0px; font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, &quot;Microsoft Yahei&quot;, &quot;Hiragino Sans GB&quot;, &quot;Heiti SC&quot;, &quot;WenQuanYi Micro Hei&quot;, sans-serif; font-size: 12px;">&nbsp; &nbsp; Content-Security-Policy: script-src &#39;self&#39;; object-src &#39;none&#39;;&nbsp;<p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); white-space: normal; background-color: rgb(255, 255, 255); border: 0px; font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, &quot;Microsoft Yahei&quot;, &quot;Hiragino Sans GB&quot;, &quot;Heiti SC&quot;, &quot;WenQuanYi Micro Hei&quot;, sans-serif; font-size: 12px;">&nbsp;&nbsp;&nbsp;&nbsp;style-src cdn.example.org third-party.org; child-src https:<p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); white-space: normal; background-color: rgb(255, 255, 255); border: 0px; font-family: &quot;Helvetica Neue&quot;, Helvetica, Arial, &quot;Microsoft Yahei&quot;, &quot;Hiragino Sans GB&quot;, &quot;Heiti SC&quot;, &quot;WenQuanYi Micro Hei&quot;, sans-serif; font-size: 12px;"> <p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);">另一种是通过网页的&lt;meta&gt;标签。&nbsp; &nbsp;<p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"><pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;&nbsp;&lt;meta&nbsp;http-equiv=&quot;Content-Security-Policy&quot;&nbsp;content=&quot;script-src&nbsp;&#39;self&#39;;&nbsp;object-src&nbsp;&#39;none&#39;;&nbsp;style-src&nbsp;cdn.example.org&nbsp;third-party.org;&nbsp;child-src&nbsp;https:&quot;&gt;</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">上面代码中，CSP 做了如下配置。 <ul style="box-sizing: border-box; margin-bottom: 10px; padding: 0px 0px 0px 40px; list-style-position: inherit; list-style-image: initial; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;" class=" list-paddingleft-2"><li>脚本：只信任当前域名</li><li>&lt;object&gt;标签：不信任任何URL，即不加载任何资源</li><li>样式表：只信任cdn.example.org和third-party.org</li><li>框架（frame）：必须使用HTTPS协议加载</li><li>其他资源：没有限制</li></ul><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">启用后，不符合 CSP 的外部资源就会被阻止加载。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">Chrome 的报错信息。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px; text-align: center;"><img src="/ueditor/php/upload/image/20170916/1505494569943562.png" alt="" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; cursor: pointer;"/><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">Firefox 的报错信息。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px; text-align: center;"><img src="/ueditor/php/upload/image/20170916/1505494569674322.png" alt="" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; cursor: pointer;"/><h2 id="2" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 30px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">二、限制选项</h2><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">CSP 提供了很多限制选项，涉及安全的各个方面。<h3 id="3" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 24px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">2.1 资源加载限制</h3><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">以下选项限制各类资源的加载。<ul style="box-sizing: border-box; margin-bottom: 10px; padding: 0px 0px 0px 40px; list-style-position: inherit; list-style-image: initial; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;" class=" list-paddingleft-2"><li>script-src：外部脚本</li><li>style-src：样式表</li><li>img-src：图像</li><li>media-src：媒体文件（音频和视频）</li><li>font-src：字体文件</li><li>object-src：插件（比如 Flash）</li><li>child-src：框架</li><li>frame-ancestors：嵌入的外部资源（比如&lt;frame&gt;、&lt;iframe&gt;、&lt;embed&gt;和&lt;applet&gt;）</li><li>connect-src：HTTP 连接（通过 XHR、WebSockets、EventSource等）</li><li>worker-src：worker脚本</li><li>manifest-src：manifest 文件</li></ul><h3 id="4" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 24px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">2.2 default-src</h3><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">default-src用来设置上面各个选项的默认值。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;&nbsp;Content-Security-Policy:&nbsp;default-src&nbsp;&#39;self&#39;</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/>上面代码限制所有的外部资源，都只能从当前域名加载。如果同时设置某个单项限制（比如font-src）和default-src，前者会覆盖后者，即字体文件会采用font-src的值，其他资源依然采用default-src的值。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <h3 id="5" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 24px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">2.3 URL 限制</h3><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">有时，网页会跟其他 URL 发生联系，这时也可以加以限制。<ul style="box-sizing: border-box; margin-bottom: 10px; padding: 0px 0px 0px 40px; list-style-position: inherit; list-style-image: initial; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;" class=" list-paddingleft-2"><li>frame-ancestors：限制嵌入框架的网页</li><li>base-uri：限制&lt;base#href&gt;</li><li>form-action：限制&lt;form#action&gt;</li></ul><h3 id="6" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 24px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">2.4 其他限制</h3><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">其他一些安全相关的功能，也放在了 CSP 里面。<ul style="box-sizing: border-box; margin-bottom: 10px; padding: 0px 0px 0px 40px; list-style-position: inherit; list-style-image: initial; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;" class=" list-paddingleft-2"><li>block-all-mixed-content：HTTPS 网页不得加载 HTTP 资源（浏览器已经默认开启）</li><li>upgrade-insecure-requests：自动将网页上所有加载外部资源的 HTTP 链接换成 HTTPS 协议</li><li>plugin-types：限制可以使用的插件格式</li><li>sandbox：浏览器行为的限制，比如不能有弹出窗口等。</li></ul><h3 id="7" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 24px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">2.5 report-uri</h3><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">有时，我们不仅希望防止 XSS，还希望记录此类行为。report-uri就用来告诉浏览器，应该把注入行为报告给哪个网址。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">&nbsp;&nbsp;&nbsp;&nbsp;Content-Security-Policy: default-src &#39;self&#39;; ...; report-uri /my_amazing_csp_report_parser;<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">上面代码指定，将注入行为报告给/my_amazing_csp_report_parser这个 URL。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">浏览器会使用POST方法，发送一个JSON对象，下面是一个例子。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">{
&nbsp;&nbsp;&quot;csp-report&quot;:&nbsp;{
&nbsp;&nbsp;&nbsp;&nbsp;&quot;document-uri&quot;:&nbsp;&quot;http://example.org/page.html&quot;,&nbsp;&nbsp;&nbsp;&nbsp;&quot;referrer&quot;:&nbsp;&quot;http://evil.example.com/&quot;,&nbsp;&nbsp;&nbsp;&nbsp;&quot;blocked-uri&quot;:&nbsp;&quot;http://evil.example.com/evil.js&quot;,&nbsp;&nbsp;&nbsp;&nbsp;&quot;violated-directive&quot;:&nbsp;&quot;script-src&nbsp;&#39;self&#39;&nbsp;https://apis.google.com&quot;,&nbsp;&nbsp;&nbsp;&nbsp;&quot;original-policy&quot;:&nbsp;&quot;script-src&nbsp;&#39;self&#39;&nbsp;https://apis.google.com;&nbsp;report-uri&nbsp;http://example.org/my_amazing_csp_report_parser&quot;
&nbsp;&nbsp;}}</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <span style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"><span style="color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; background-color: rgb(255, 255, 255);"><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px; text-align: center;"><img src="/ueditor/php/upload/image/20170916/1505494569884221.png" alt="" style="box-sizing: border-box; border: 0px; vertical-align: middle; max-width: 100%; cursor: pointer;"/><h2 id="8" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 30px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">三、Content-Security-Policy-Report-Only</h2><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">除了Content-Security-Policy，还有一个Content-Security-Policy-Report-Only字段，表示不执行限制选项，只是记录违反限制的行为。它必须与report-uri选项配合使用。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;Content-Security-Policy-Report-Only:&nbsp;default-src&nbsp;&#39;self&#39;;&nbsp;...;&nbsp;report-uri&nbsp;/my_amazing_csp_report_parser;</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <span style="box-sizing: border-box; font-weight: 700; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; background-color: rgb(255, 255, 255); line-height: 2;">四、选项值<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">每个限制选项可以设置以下几种值，这些值就构成了白名单。<ul style="box-sizing: border-box; margin-bottom: 10px; padding: 0px 0px 0px 40px; list-style-position: inherit; list-style-image: initial; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;" class=" list-paddingleft-2"><li>主机名：example.org，https://example.com:443</li><li>路径名：example.org/resources/js/</li><li>通配符：*.example.org，*://*.example.com:*（表示任意协议、任意子域名、任意端口）</li><li>协议名：https:、data:</li><li>关键字&#39;self&#39;：当前域名，需要加引号</li><li>关键字&#39;none&#39;：禁止加载任何外部资源，需要加引号</li></ul><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">多个值也可以并列，用空格分隔。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;Content-Security-Policy:&nbsp;script-src&nbsp;&#39;self&#39;&nbsp;https://apis.google.com</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> 如果同一个限制选项使用多次，只有第一次会生效。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;错误的写法&nbsp;script-src&nbsp;https://host1.com;&nbsp;script-src&nbsp;https://host2.com&nbsp;
&nbsp;&nbsp;&nbsp;&nbsp;#&nbsp;正确的写法&nbsp;script-src&nbsp;https://host1.com&nbsp;https://host2.com</pre><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/>如果不设置某个限制选项，就是默认允许任何值。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <h2 id="9" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 30px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">五、script-src 的特殊值</h2><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">除了常规值，script-src还可以设置一些特殊值。注意，下面这些值都必须放在单引号里面。<ul style="box-sizing: border-box; margin-bottom: 10px; padding: 0px 0px 0px 40px; list-style-position: inherit; list-style-image: initial; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;" class=" list-paddingleft-2"><li>&#39;unsafe-inline&#39;：允许执行页面内嵌的&amp;lt;script&gt;标签和事件监听函数</li><li>unsafe-eval：允许将字符串当作代码执行，比如使用eval、setTimeout、setInterval和Function等函数。</li><li>nonce值：每次HTTP回应给出一个授权token，页面内嵌脚本必须有这个token，才会执行</li><li>hash值：列出允许执行的脚本代码的Hash值，页面内嵌脚本的哈希值只有吻合的情况下，才能执行。</li></ul><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">nonce值的例子如下，服务器发送网页的时候，告诉浏览器一个随机生成的token。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"><pre style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; word-wrap: break-word; overflow: auto; font-size: 13px; border-radius: 2px; line-height: 1.42857; font-family: Menlo, Monaco, Consolas, &quot;Courier New&quot;, monospace; word-break: break-all; color: rgb(51, 51, 51); border: none; background-color: rgb(255, 255, 255);"> </pre><span style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <span style="color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; background-color: rgb(255, 255, 255);"><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> 页面内嵌脚本，必须有这个token才能执行。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-none" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;&nbsp;&lt;script&nbsp;nonce=EDNnf03nceIOfn39fn3e9h3sdfa&gt;&nbsp;//&nbsp;some&nbsp;code&nbsp;&lt;/script&gt;</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/>hash值的例子如下，服务器给出一个允许执行的代码的hash值。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;Content-Security-Policy:&nbsp;script-src&nbsp;&#39;sha256-qznLcsROx4GACP2dm0UCKCzCG-HiZ1guq6ZZDob_Tng=&#39;</pre><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/>下面的代码就会允许执行，因为hash值相符。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;&nbsp;&lt;script&gt;alert(&#39;Hello,&nbsp;world.&#39;);&lt;/script&gt;</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> 注意，计算hash值的时候，&lt;script&gt;标签不算在内。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">除了script-src选项，nonce值和hash值还可以用在style-src选项，控制页面内嵌的样式表。<h2 id="10" style="box-sizing: border-box; margin: 20px 0px 10px; padding: 0px; font-size: 30px; font-weight: 500; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; line-height: 1.1; white-space: normal; background-color: rgb(255, 255, 255);">六、注意点</h2><p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">（1）script-src和object-src是必设的，除非设置了default-src。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">因为攻击者只要能注入脚本，其他限制都可以规避。而object-src必设是因为 Flash 里面可以执行外部脚本。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">（2）script-src不能使用unsafe-inline关键字（除非伴随一个nonce值），也不能允许设置data:URL。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;">下面是两个恶意攻击的例子。<p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;&lt;img&nbsp;src=&quot;x&quot;&nbsp;onerror=&quot;evil()&quot;&gt;&nbsp;&lt;script&nbsp;src=&quot;data:text/javascript,evil()&quot;&gt;&lt;/script&gt;</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> （3）必须特别注意 JSONP 的回调函数。<br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/><p style="box-sizing: border-box; margin-top: 0px; margin-bottom: 10px; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"> <p style="box-sizing: border-box; padding: 0px; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255); line-height: 18px;"> <pre class=" language-bash" style="box-sizing: border-box; padding: 1em; word-wrap: normal; overflow: auto; font-size: 13px; border-radius: 0.3em; line-height: 1.5; font-family: Consolas, Monaco, &quot;Andale Mono&quot;, &quot;Ubuntu Mono&quot;, monospace; word-break: normal; color: rgb(248, 248, 242); border: none; text-shadow: rgba(0, 0, 0, 0.3) 0px 1px; direction: ltr; tab-size: 4; hyphens: none; background-color: rgb(39, 40, 34);">&nbsp;&nbsp;&nbsp;&nbsp;&lt;script&nbsp;src=&quot;/path/jsonp?callback=alert(document.domain)//&quot;&gt;&nbsp;&lt;/script&gt;</pre><br style="box-sizing: border-box; color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; white-space: normal; background-color: rgb(255, 255, 255);"/>上面的代码中，虽然加载的脚本来自当前域名，但是通过改写回调函数，攻击者依然可以执行恶意代码。<span style="color: rgb(51, 51, 51); font-family: PingFangSC, &quot;helvetica neue&quot;, &quot;hiragino sans gb&quot;, arial, &quot;microsoft yahei ui&quot;, &quot;microsoft yahei&quot;, simsun, sans-serif; background-color: rgb(249, 249, 249);">