为什么这是CSP违规？当明确允许'self'时,blocked-uri = self

Question

我无法理解下面的CSP违规报告(由FireFox 44.0.2/Ubuntu发送).这里真正被阻止的是什么？为什么？应该注意的是,如果我写'self'或(在报告中自动翻译)https://www.example.com到CSP标题中并不重要.此外,我不知道渲染页面中缺少任何内容.那我该怎么办呢？(显然,如果每个页面都触发虚假违规报告,我不应该在我的实际网站中添加报告)

{
    "csp-report":{
        "blocked-uri":"self",
        "document-uri":"https://www.example.com/foo/bar/baz.html",
        "original-policy":"report-uri https://reportserver.example.com/ContentSecurityPolicy-report.php; 
            default-src https://www.example.com; 
            style-src https://example.com https://www.example.com https://fonts.googleapis.com; 
            script-src https://www.example.com https://code.jquery.com https://ajax.googleapis.com; 
            font-src https://fonts.gstatic.com",
        "referrer":"https://www.example.com/foo/bar/wtf.html",
        "source-file":"https://www.example.com/foo/bar/baz.html",
        "violated-directive":"style-src https://example.com https://www.example.com https://fonts.googleapis.com"
    }
}

Answer 1

通过将您的策略​​设置为：

default-src 'self'; style-src example.com www.example.com 'self' https://fonts.googleapis.com 'unsafe-inline'; script-src 'self' https://code.jquery.com https://ajax.googleapis.com; font-src https://fonts.gstatic.com 'self';

我没有看到任何违规行为。我将“unsafe-inline”添加到样式 src，将“self”添加到 font-src。