Hacker News Reader

Comment by j13n | Hacker News Reader

This is the second post I’ve seen praising Datastar in the last 24 hours, and once again no mention of the requirement to punch a gaping hole in one’s Content-Security-Policy.

If this is the framework of the future, cyber criminals are going to have a bright future!

View on HN

That's the nature of anything that does this kind of work. React, Svelte, Solid. Alpine has a CSP version but it does so little that I recommend you just accept being a Web1 MPA basic site.

I have ideas around ways around this but it's a per language template middleware.

Is there anything I could read detailed explanation of issue, in particular w.r.t datastar?

Alpine CSP version works fine. You just can't write JS code in strings, which one may wish to avoid anyway.

I also didn't have a problem with CSP and HTMX.

Nor with SvelteKit.

I'm not sure why you think these are all equivalent to DataStar's hard requirement on unsafe-eval.

FYI, this is the reason I didn't try out DataStar.

Svelte only requires a CSP hole in its default config as a standalone library; SvelteKit does proper CSP by default, and if you're not using SvelteKit you can build CSP handling into whatever you are using instead. I assume the others are the same way.

Could you avoid eval by having a CSP mode that forces reactive expressions to only allow functions users have registered with datastar in a lookup table?

Please don't cargo cult CSP without understanding it.

unsafe-eval constrained to function constructors without inline scripts is only a concern if you are rendering user submitted HTML (most common case I see is markdown). Regardless of your CSP configuration you should be sanitizing that user submitted HTML anyway.

How does this compare to HTMX (security wise)?

Same, you control your signals and fragments. So you are responsible for proper escaping and thoughtful design.

You can disable all use of eval with htmx. The tradeoff is one has to write a bit more JavaScript.

https://news.ycombinator.com/item?id=43650921

I have thoughts about a fully compliant CSP middleware, problem is it's per language so I'd probably only make for Go (maybe PHP & TS)

Hashes or nonces?

Hashed script content

Thank you for doing this. Is it possible to follow the work somewhere?

Not right now. CSP in a Datastar context is mostly a red herring. If an enterprise wants it to check a box then please reach out.

I don't represent an enterprise; just a dev. It would make it easier to sell the idea of Datastar to clients if it was compatible with strict CSP.

could you please elaborate on this?

Reply on news.ycombinator.com