@ember/sentry generates inline script tags that break a secure Content-Security-Policy (CSP)

[Ramblurr]

Is there an existing issue for this?

• I have checked for existing issues https://github.com/getsentry/sentry-javascript/issues
• I have reviewed the documentation https://docs.sentry.io/
• I am using the latest SDK release https://github.com/getsentry/sentry-javascript/releases

How do you use Sentry?

Sentry Saas (sentry.io)

Which package are you using?

@sentry/ember

SDK Version

6.19.7

Framework Version

No response

Link to Sentry event

No response

Steps to Reproduce

1. Install @ember/sentry
2. Configure CSP as described in the docs
3. Configure the ember sentry addon to sent tracing (e.g., sentry.tracesSampleRate = 0.2)
4. Run the app in production mode

Expected Result

There are no CSP violations originating from sentry code.

Actual Result

There are two unsafe-inline script violations:

Two inline script tags are injected:

<script>if (window.performance && window.performance.mark) {
  window.performance.mark('@sentry/ember:initial-load-start');
}
</script>

<script>if (window.performance && window.performance.mark) {
  window.performance.mark('@sentry/ember:initial-load-end');
}
</script>

The best solution would be to ensure those code snippets are stable, generate the sha256 hash and publish them as part of the documentation. If those hashes ever change that would be a breaking change and would need to be flagged in release notes.

Another, although much less desirable solution, would be to provide an option to disable page load measurements when tracing is enabled such that those snippets are not injected.

[lforst]

Hi @Ramblurr, thanks for raising this issue. We will look into it!

[kjarri]

I see this was closed, but the issue is still there. To get around this for now, I added the current hashes for the scripts, but that will break if the scripts change in the future.

Is there anything else I can do (except for 'unsafe-inline' in script-src-elem. I won't do that.)

[lforst]

Hi, I just merged in #5089 which will export a field injectedScriptHashes from the package. It holds an array of hashes of all injected script tags, so you should be able to use it in CSP headers/meta tags.

We currently froze development on version 6 of the SDK to prepare for version 7. This means that this change will be included earliest in the next beta or release candidate version of v7. Please keep an eye out for that.

[AbhiPrasad]

Released as part of 7.0.0: https://github.com/getsentry/sentry-javascript/blob/master/CHANGELOG.md#700