'Why is my implementation of CSP returning errors?

I'm trying to add CSP to a page of a PHP application but I'm getting the error

The Content-Security-Policy directive name 'script‑src' contains one or more invalid characters. Only ASCII alphanumeric characters or dashes '-' are allowed in directive names.

This is how I'm trying to implement CSP

<?php
// forum.php: Forum...
header("Content-Security-Policy: script‑src self;default‑src self;media‑src none;img‑src self;");
?>
            <h1>Welcome to your forum</h1>
            <h2>Post a message bellow:</h2>
            <form name=posttoforumform method=POST action="<?php echo $_SERVER['SCRIPT_NAME'] . "?" . $_SERVER['QUERY_STRING']?>">
                <!--<p><input type="text" name="user_name" size="20"></p> -->
                <p><textarea rows="5" cols="80" name="input_from_form" size="20"></textarea></p>
                <p><input type="submit" value="Submit" name="Submit_button" content="text/html; charset=utf-8"></p>
            </form>

<?php
// Grab inputs
$inputfromform = mysql_real_escape_string($_REQUEST["input_from_form"]);
$showonlyuser =  $_REQUEST["show_only_user"];

if ($inputfromform  <> "") {    
    //$pattern = "<script>";
    //if(!preg_match($pattern, $inputfromform)){
        $query = "INSERT INTO forum_table(poster_name, comment, date) VALUES ('".
        $user->username . "', '".
        $inputfromform  . "', " .
        " now() )";
        $result = execute_query($query);
    /*}else{        
        echo '<script>alert("Nice try! Your Cross XSS has not been succcessfully delivered :P")</script>';
    }*/ 
}

?>

I also tried to implement CSP by using .httaccess file like this

Header set Content-Security-Policy "
    default-src 'self';
    script-src 'self';
    img-src 'self';
"

But I get this error

The server encountered an internal error or misconfiguration and was unable to complete your request.

Please contact the server administrator, webmaster@localhost and inform them of the time the error occurred, and anything you might have done that may have caused the error.

More information about this error may be available in the server error log.

Why is this happening?

phpsecuritywebheadercontent-security-policyrandomluanumbersgenerate


Solution 1:[1]

There are many variations of very similar characters that look like dash (em dash, en dash, minus sign, hyphen etc.). The error message states "Only ASCII alphanumeric characters or dashes '-' are allowed in directive names." Now take the - character from the error message and search for it on this page and you will see that in your line

header("Content-Security-Policy: script?src self;default?src self;media?src none;img?src self;");

only the dashes in "Content-Security-Policy" match, the ones you use in the directives are charecters that look the same. Such changes to characters often happens when word processors handle dashes. If your code has been copied to e.g. MS Word and back your dashes are no longer the same.

You also seem to define two Content-Security-Policies. This means that everything need to pass both policies, another policy can only make it stricter.

Solution 2:[2]

The behaviour of the pseudo-random number generator changed in Lua 5.4. The 5.4 Reference Manual states, under §8.2 – Incompatibilities in the Libraries, that

The pseudo-random number generator used by the function math.random now starts with a somewhat random seed. Moreover, it uses a different algorithm.

If you are curious, that new algorithm is xoshiro256**.

What this means is that programs running in Lua environments prior to 5.4 must explicitly call math.randomseed to seed the pRNG. You want to do this only once in your program.

Without seeding the pRNG, the sequence of numbers produced will be the same each time you run your program. This is because, prior to 5.4, Lua's math.random is implemented using C rand or POSIX random, both of which default to a seed of 1 if not explicitly seeded.

The classic way to seed a pRNG is to use the current time (os.time). This is a simple approach, but has the fault that running this program twice in the same second will have the same result.

local counter = 0
local a = 0
local b = 1

math.randomseed(os.time())

while a ~= b do
    a = math.random(1, 1000000)
    b = math.random(1, 100)
    counter = counter + 1

    if a == b then
        print(a .. ", " .. b .. ", and it took " .. counter .. " times")
    end
end

Documentation links, for comparison:

5.3: math.random math.randomseed
5.4: math.random math.randomseed

Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source
Solution 1 Halvor Sakshaug
Solution 2

Related Questions