Summary
Tauri's CSP nonce hardening does not prevent script execution when the application's script-src directive permits data: or blob: sources. An attacker who can influence content or execution paths within the application may abuse those allowed schemes to run arbitrary script without obtaining the nonce.
Affected context
The issue occurs in Tauri applications that rely on nonce-based Content Security Policy protection while also allowing data: or blob: in script-src. Under CSP Level 3 processing rules, these scheme sources remain permitted independently of a nonce, so the intended restriction is weakened when application content or script-loading behavior can be influenced.
Exploit preconditions
- Attack surface: A Tauri application's webview and its Content Security Policy
- Required access: Ability to influence application content, script references, or a code path that creates permitted
data:orblob:script sources - Trigger point: Script loading or execution within the application webview
- Why exploitation is possible:
data:andblob:scheme sources remain authorized byscript-srceven when nonce-based authorization is also configured
Why this happens
The underlying flaw is an incomplete CSP trust model. The application treats a nonce as if it exclusively authorizes script execution, while the policy also grants independent authorization to data: and blob: scheme sources. This maps to CWE-79: Improper Neutralization of Input During Web Page Generation, because attacker-influenced content may be interpreted as executable script when policy controls do not adequately constrain it.
Potential impact
- An attacker may execute arbitrary script in the Tauri webview
- Application data or user-interface content could be read or altered
- Script execution could potentially interact with exposed Tauri commands or APIs
- The application may experience privilege abuse, data theft, or unauthorized actions
General mitigation guidance
Mitigation generally focuses on reducing allowed script sources and aligning CSP configuration with the application's actual execution model.
Common defensive patterns include:
- Removing
data:andblob:fromscript-srcunless they are strictly required - Using narrowly scoped nonce or hash authorization for trusted scripts
- Separating untrusted content from privileged application webviews
- Restricting Tauri command exposure and validating command inputs
- Avoiding dynamic script construction and minimizing runtime-generated executable content
- Applying least privilege to application capabilities and webview integrations
These measures reduce reliance on a nonce as the sole control and limit the consequences of any script execution.
How teams detect issues like this
Organizations can identify this class of issue through:
- Static analysis of CSP declarations for
data:orblob:inscript-src - Code review checks for dynamic script creation, webview navigation, and attacker-influenced content
- Policy tests that verify only approved nonces, hashes, and script origins can authorize execution
- Runtime inspection of effective CSP headers or meta policies in packaged applications
- CI rules that reject broad script sources unless an explicitly reviewed exception exists
Automated security scanning and code review tools may help identify permissive CSP patterns, but application-specific review remains important.
