Trusted types feedback

[tskarhed]

Currently in development. Trusted types is an experimental Javascript API with limited browser support.

Trusted types reduce the risk of DOM XSS by enforcing developers to sanitize strings that are used in injection sinks, such as setting innerHTML on an element. Furthermore, when enabling trusted types, these injection sinks need to go through a policy that will sanitize, or leave the string intact and return it as "safe". This provides some protection from client side injection vulnerabilities in third party libraries, such as jQuery, Angular and even third party plugins.

To enable trusted types in enforce mode, where injection sinks are automatically sanitized:

1. Enable content_security_policy in the configuration.
2. Add require-trusted-types-for 'script' to the content_security_policy_template in the configuration.
3. Check if Grafana is function properly, and report any odd behavior in this discussion thread.

To enable trusted types in report mode, where inputs that have not been sanitized with trusted types will be logged to the console:

1. Enable content_security_policy_report_only in the configuration.
2. Add require-trusted-types-for 'script' to the content_security_policy_report_only_template in the configuration.
3. Check if Grafana is function properly, and report any odd behavior in this discussion thread.

As this is very early stages and we do not yet know the full extent of issues that may appear, it is important that we get feedback from the community about things breaking. Please leave a comment!

[gelicia]

Hello, as you may have heard, we are transitioning away from using discussions to discuss feature requests. This is phrased as a discussion, and we'd like discussions about grafana to go to our community forum. Thank you!

[mgenti]

Since this ticket is still referenced in the docs, I thought I should respond here.

Today our OSS version 10.1.7 of grafana started throwing errors about not being able to find datasources and plugins. After troubleshooting it was found that switching content_security_policy_template from default-src *; style-src * 'unsafe-inline'; to script-src 'self' 'unsafe-eval' 'unsafe-inline' 'strict-dynamic' $NONCE;object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline' blob:;img-src * data:;base-uri 'self';connect-src 'self' grafana.com ws://$ROOT_PATH wss://$ROOT_PATH;manifest-src 'self';media-src 'none';form-action 'self'; fixed our issue.

[gelicia]

@mgenti Thanks for the comment about this being in the docs - that was an oversight. I started the ball rolling on getting a place to gather feedback somewhere else and will update the docs shortly after.