nonce is not inserted when creating ppms.js script tag

[aximusnl]

Piwik is inserting the following script:

<script type="text/javascript">
    try {
      
    var _paq = _paq || [];
    _paq.push(['setTrackingSource', 'jstc_tm']);
    _paq.push(['enableLinkTracking']);
    _paq.push(['setIpTracking', true]);
    _paq.push(['setDomains', ['my-domain.com']]);
    _paq.push(['trackPageView']);
    _paq.push(['enableJSErrorTracking']);
    (function(p,i,w,ik) {
        var g=ik.createElement('script'),s=ik.getElementsByTagName('script')[0];
        _paq.push(['setTrackerUrl', p]);
        _paq.push(['setSiteId', w]);
        g.type='text/javascript';g.async=true;g.defer=true;g.src=i;s.parentNode.insertBefore(g,s);
    })('https://some-piwikpro-domain.com/ppms.php','https://some-piwikpro-domain.com/ppms.js','XXXXXX',document)

    } catch (error) {
      console.error('Failed to evaluate tag - ' + "Piwik PRO" + ': ' + error.message)      
    }
</script>

This script is given the correct nonce by rewriteScriptElement.

But the script it inserts is creating a new script (var g = ik.createElement('script')) which should also be given the correct nonce.

[auto200]

Hey, @aximusnl please follow our CSP guide
here is the example policy that you could apply:

default-src 'self';
script-src 'self' ORG_NAME.containers.piwik.pro ORG_NAME.piwik.pro 'nonce-8IBTHwOdqNKAWeKl7plt8g==';
connect-src 'self' ORG_NAME.containers.piwik.pro ORG_NAME.piwik.pro;
img-src 'self' ORG_NAME.containers.piwik.pro ORG_NAME.piwik.pro;
style-src 'self' 'nonce-8IBTHwOdqNKAWeKl7plt8g==';

[aximusnl]

Hi, @auto200

Thank you for your feedback. That does indeed work and it temporarily fixes the problem.

But that's not proper nonce support. So there is still a bug on Piwik's side, where the nonce is not correctly set in consequent requests. The solution (real nonce support) is supplied in my first post.

[auto200]

@aximusnl Can you share an example CSP configuration what You wish to use but our current setup does not support?

[aximusnl]

@auto200 We are drifting away from the problem. There is a bug in Piwik's nonce support (see my original post).

This line of code (inside Piwik) ik.createElement('script') inserts a script that does not have the nonce set correctly.

Yes, there may be alternative solutions (whitelisting the domain) but that's not the point. The point is the bug.

[pawfa]

Hi @aximusnl

We’ve looked into this again.

We understand your concern regarding the dynamically created <script> element. However, we do not consider this to be a bug in Piwik PRO.

When using a CSP nonce, dynamically created scripts don’t automatically inherit it. This is expected CSP behavior, and CSP provides other mechanisms to handle such cases depending on the policy you want to enforce.

This can be resolved using one of the following approaches:

• allowlisting the domain, mentioned above, or
• using strict-dynamic:
  https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Content-Security-Policy/script-src#strict-dynamic

Both are standard CSP approaches that maintain a high level of security while allowing Piwik PRO to work correctly.