nonce is not inserted when creating ppms.js script tag

[aximusnl]

Piwik is inserting the following script:

<script type="text/javascript">
    try {
      
    var _paq = _paq || [];
    _paq.push(['setTrackingSource', 'jstc_tm']);
    _paq.push(['enableLinkTracking']);
    _paq.push(['setIpTracking', true]);
    _paq.push(['setDomains', ['my-domain.com']]);
    _paq.push(['trackPageView']);
    _paq.push(['enableJSErrorTracking']);
    (function(p,i,w,ik) {
        var g=ik.createElement('script'),s=ik.getElementsByTagName('script')[0];
        _paq.push(['setTrackerUrl', p]);
        _paq.push(['setSiteId', w]);
        g.type='text/javascript';g.async=true;g.defer=true;g.src=i;s.parentNode.insertBefore(g,s);
    })('https://some-piwikpro-domain.com/ppms.php','https://some-piwikpro-domain.com/ppms.js','XXXXXX',document)

    } catch (error) {
      console.error('Failed to evaluate tag - ' + "Piwik PRO" + ': ' + error.message)      
    }
</script>

This script is given the correct nonce by rewriteScriptElement.

But the script it inserts is creating a new script (var g = ik.createElement('script')) which should also be given the correct nonce.

[auto200]

Hey, @aximusnl please follow our CSP guide
here is the example policy that you could apply:

default-src 'self';
script-src 'self' ORG_NAME.containers.piwik.pro ORG_NAME.piwik.pro 'nonce-8IBTHwOdqNKAWeKl7plt8g==';
connect-src 'self' ORG_NAME.containers.piwik.pro ORG_NAME.piwik.pro;
img-src 'self' ORG_NAME.containers.piwik.pro ORG_NAME.piwik.pro;
style-src 'self' 'nonce-8IBTHwOdqNKAWeKl7plt8g==';

[aximusnl]

Hi, @auto200

Thank you for your feedback. That does indeed work and it temporarily fixes the problem.

But that's not proper nonce support. So there is still a bug on Piwik's side, where the nonce is not correctly set in consequent requests. The solution (real nonce support) is supplied in my first post.

[auto200]

@aximusnl Can you share an example CSP configuration what You wish to use but our current setup does not support?

[aximusnl]

@auto200 We are drifting away from the problem. There is a bug in Piwik's nonce support (see my original post).

This line of code (inside Piwik) ik.createElement('script') inserts a script that does not have the nonce set correctly.

Yes, there may be alternative solutions (whitelisting the domain) but that's not the point. The point is the bug.