未找到 Content-Security-Policy 元标记错误

Posted 2023-03-15

【中文标题】未找到 Content-Security-Policy 元标记错误

【英文标题】：No Content-Security-Policy meta tag found error

【发布时间】：2015-08-06 05:42:47

【问题描述】：

我正在离子框架中构建我的应用程序。我已经安装了cordova白名单插件，下面是我的config.xml，但我仍然收到错误

I/chromium( 2446): [INFO:CONSOLE(173)] "No Content-Security-Policy meta tag found. 
Please add one when using the cordova-plugin-whitelist plugin.", source: 
file:///android_asset/www/plugins/cordova-plugin-console/www/console-via-logger.js (173)

我的 config.xml 是

<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
<widget id="com.ionicframework.public279104" version="0.0.1" xmlns="http://www.w3.org/ns/widgets" xmlns:cdv="http://cordova.apache.org/ns/1.0">
  <name>public</name>
  <description>
        An Ionic Framework and Cordova project.
    </description>
  <author email="hi@ionicframework" href="http://ionicframework.com/">
      Ionic Framework Team
    </author>
  <content src="index.html"/>
  <!-- <allow-navigation href="*" /> -->
  <allow-navigation href="http://*/*" />
  <allow-navigation href="https://*/*" />
  <allow-navigation href="data:*" />
  <allow-intent href="*" />
  <access origin="*"/>
  <preference name="webviewbounce" value="false"/>
  <preference name="UIWebViewBounce" value="false"/>
  <preference name="DisallowOverscroll" value="true"/>
  <preference name="android-minSdkVersion" value="16"/>
  <preference name="BackupWebStorage" value="none"/>
  <preference name="SplashScreen" value="screen"/>
  <preference name="SplashScreenDelay" value="3000"/>
  <feature name="StatusBar">
    <param name="ios-package" value="CDVStatusBar" onload="true"/>
  </feature>
  <platform name="android">
    <icon src="resources/android/icon/drawable-ldpi-icon.png" density="ldpi"/>
    <icon src="resources/android/icon/drawable-mdpi-icon.png" density="mdpi"/>
    <icon src="resources/android/icon/drawable-hdpi-icon.png" density="hdpi"/>
    <icon src="resources/android/icon/drawable-xhdpi-icon.png" density="xhdpi"/>
    <icon src="resources/android/icon/drawable-xxhdpi-icon.png" density="xxhdpi"/>
    <icon src="resources/android/icon/drawable-xxxhdpi-icon.png" density="xxxhdpi"/>
    <splash src="resources/android/splash/drawable-land-ldpi-screen.png" density="land-ldpi"/>
    <splash src="resources/android/splash/drawable-land-mdpi-screen.png" density="land-mdpi"/>
    <splash src="resources/android/splash/drawable-land-hdpi-screen.png" density="land-hdpi"/>
    <splash src="resources/android/splash/drawable-land-xhdpi-screen.png" density="land-xhdpi"/>
    <splash src="resources/android/splash/drawable-land-xxhdpi-screen.png" density="land-xxhdpi"/>
    <splash src="resources/android/splash/drawable-land-xxxhdpi-screen.png" density="land-xxxhdpi"/>
    <splash src="resources/android/splash/drawable-port-ldpi-screen.png" density="port-ldpi"/>
    <splash src="resources/android/splash/drawable-port-mdpi-screen.png" density="port-mdpi"/>
    <splash src="resources/android/splash/drawable-port-hdpi-screen.png" density="port-hdpi"/>
    <splash src="resources/android/splash/drawable-port-xhdpi-screen.png" density="port-xhdpi"/>
    <splash src="resources/android/splash/drawable-port-xxhdpi-screen.png" density="port-xxhdpi"/>
    <splash src="resources/android/splash/drawable-port-xxxhdpi-screen.png" density="port-xxxhdpi"/>
  </platform>
</widget>

为什么会这样？我的应用程序也经常崩溃，并显示“您的应用程序不幸停止工作”的消息

【问题讨论】：

去github.com/apache/cordova-plugin-whitelist。

【参考方案1】：

白名单可以允许/阻止来自 Cordova 提供的 WebView（iOS 为UIWebView，Android 为WebView）的某些协议（例如 HTTP/HTTPS）的网络请求。

但是它不能过滤所有类型的请求（<video>、<media>、sockets 为例），所以需要Content-Security-Policy 来过滤。

这是通过 HTML 文件中的元标记控制的：

<!-- Good default declaration:
    * gap: is required only on iOS (when using UIWebView) and is needed for JS->native communication
    * https://ssl.gstatic.com is required only on Android and is needed for TalkBack to function properly
    * Disables use of eval() and inline scripts in order to mitigate risk of XSS vulnerabilities. To change this:
        * Enable inline JS: add 'unsafe-inline' to default-src
        * Enable eval(): add 'unsafe-eval' to default-src
-->
<meta http-equiv="Content-Security-Policy" content="default-src 'self' data: gap: https://ssl.gstatic.com; style-src 'self' 'unsafe-inline'; media-src *">

<!-- Allow requests to foo.com -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self' foo.com">

<!-- Enable all requests, inline styles, and eval() -->
<meta http-equiv="Content-Security-Policy" content="default-src *; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' 'unsafe-eval'">

<!-- Allow XHRs via https only -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self' https:">

<!-- Allow iframe to https://cordova.apache.org/ -->
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; frame-src 'self' https://cordova.apache.org">

更多信息：https://github.com/apache/cordova-plugin-whitelist。

编辑：关于您的应用程序为何不断崩溃的问题，我无法根据提供的信息确定原因，因此我需要更多信息。

但它与Content-Security-Policy 无关。

也许一些 Android/iOS 日志会有所帮助。