Skip to main content

Content Security Policy

info

This content is intended for advanced Studio users.

The Better Studio Form Renderer uses controlled script evaluation in a restricted execution environment. While the Content Security Policy (CSP) directives unsafe-inline and unsafe-eval are present, the renderer applies several protective measures that prevent arbitrary code execution and significantly reduce the attack surface.

Security characteristics​

No access to global browser objects​

Before any evaluated script is executed, the following global browser objects are explicitly set to undefined:

  • window
  • document
  • self
  • parent
  • fetch
  • XMLHttpRequest

With these objects removed, executed scripts cannot access:

  • DOM APIs
  • Browser navigation
  • The surrounding runtime environment
  • Cookies or local storage
  • Session data

This eliminates the common attack vectors normally associated with script evaluation.

Strict mode enforcement​

All evaluated scripts run in strict mode, which disables several JavaScript features that are often used to escape limited execution contexts. This includes:

  • Implicit creation of global variables
  • Access to the global this object
  • Use of the arguments.callee property
  • Scope manipulation through the with statement

Together with the removal of window, document, and all DOM access, strict mode significantly limits the ability of code to break out of the controlled context.

CSP nonce support​

The renderer automatically assigns a CSP nonce to every dynamically generated script. This ensures that:

  • Only scripts produced by the renderer can execute
  • Injected or altered scripts cannot obtain a valid nonce
  • CSP continues to enforce script integrity

Nonce behaviour can be configured using the cspSettings option in the renderer configuration. See the renderer configuration reference for details.

HTML sanitisation​

All user-provided HTML content is processed by Angular DomSanitizer before rendering. The sanitiser:

  • Cleans the HTML
  • Removes script tags and event handlers
  • Strips dangerous or unexpected attributes

This prevents cross-site scripting payloads from entering or executing within the renderer.

Frequently asked questions (FAQs)​

Does the renderer require unsafe-inline or unsafe-eval CSP directives?

The renderer uses both directives, but applies protective measures that significantly reduce the associated risk. Global browser objects are removed before script execution, all scripts run in strict mode, a CSP nonce is assigned to every dynamically generated script, and all user-provided HTML is sanitised before rendering.

What browser objects does the renderer remove before executing scripts?

The renderer sets window, document, self, parent, fetch, and XMLHttpRequest to undefined before any evaluated script runs. This removes access to DOM APIs, browser navigation, cookies, local storage, and session data.

What does CSP nonce support mean in practice?

The renderer automatically assigns a nonce to every dynamically generated script. Only scripts produced by the renderer can obtain a valid nonce, so injected or altered scripts cannot execute even when unsafe-inline is present.

How is user-provided HTML content handled?

All user-provided HTML is processed by Angular DomSanitizer before rendering. The sanitiser removes script tags, event handlers, and dangerous attributes, preventing cross-site scripting payloads from entering or executing within the renderer.

Can I configure the CSP nonce behaviour?

Yes. Nonce behaviour can be configured using the cspSettings option in the renderer configuration. See the renderer configuration reference for details.