Skip to main content

A small tool and library to generate the hashes of inline content that needs to be whitelisted when serving an HTML document with a Content-Security-Policy (because, as the name indicates, using unsafe-inline is not recommended).

You provide the HTML content (directly or through a file path/URL) then inlinehashes will parse the document and provide you with a list of elements that need to be explicitly added to the CSP header/tag.

The tool can be specially useful for scenarios where you use/include external software solutions in your website or application (such as a 3rd party CMS, etc), since it will allow you to detect changes after updates and edit you CSP accordingly.

Quick note: Always verify the content you are whitelisting and be careful when fetching live website data, since any existing XSS code will be included in the results.

At the moment this package is still in a very early stage, so it still doesn’t detect all possible items and the current API might change with future releases.

Inline content that is currently detected:

  • <script></script> tags

  • <style></style> tags

  • Many event handlers defined in element/tag attributes

  • Styles defined directly in the element/tag using the style attribute

Installation

Using pip you just need to pip install inlinehashes

Usage

The package can be used through 2 different ways, either by using the CLI interface or programmatically in your python project. Bellow you can find a quick summary of the available functionality.

CLI app

This is the available functionality:

usage: inlinehashes [-h] [-a {sha256,sha384,sha512}] [-o {table,json,plain}] [-t {all,script-src,style-src}] source

positional arguments:
  source                URL or local HTML file to check

options:
  -h, --help            show this help message and exit
  -a {sha256,sha384,sha512}, --alg {sha256,sha384,sha512}
                        Hash algorithm to use (default: sha256)
  -o {table,json,plain}, --output {table,json,plain}
                        Format used to write the output (default: table)
  -t {all,script-src,style-src}, --target {all,script-src,style-src}
                        Target inline content to look for (default: all)

Here is an example of the output:

$inlinehashes https://ovalerio.net -a sha384 -o json
[
  {
    "content": "\n      html {\n        height: 100%;\n      }\n      ",
    "hash": "sha384-Ku20lQH5qbr4EDPzXD2rf25rEHJNswNYRUNMPjYl7jCe0eHJYDe0gFdQpnKkFUTv",
    "directive": "style-src",
    "line": 12,
    "position": 0
  }
]

Library

Here is the same example, but using python’s shell:

>>> import requests
>>> import inlinehashes
>>> content = requests.get("https://ovalerio.net").text
>>> inlines = inlinehashes.parse(content)
>>> inlines
[Inline(line='17', position='0')]
>>> first = inlines[0]
>>> first.short_content
'\n      html {\n        height: 100%;\n      }\n      '
>>> first.sha256
'sha256-aDiwGOuSD1arNOxmHSp89QLe81yheSUQFjqpWHYCpRY='
>>> first.sha384
'sha384-Ku20lQH5qbr4EDPzXD2rf25rEHJNswNYRUNMPjYl7jCe0eHJYDe0gFdQpnKkFUTv'
>>> first.sha512
'sha512-cBO6RNy87Tx3HmpXRZUs/DPxGq9ZOqIZ9cCyDum0kNZeLEWVvW5DtYFRmHcQawnAoWeeRmll4aJeLXTb2OLBlA=='
>>> first.content
'\n      html {\n        height: 100%;\n      }\n      body {\n        background-image: url("data:image/png;base64,iVBORw0KGgoAAAANS...'

Contributions

All contributions and improvements are welcome.

Metadata

Release files for inlinehashes 0.0.5

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for inlinehashes 0.0.5
File Size Uploaded
inlinehashes-0.0.5.tar.gz 7.1 kB Details

Built distribution (wheel)

Table of built distributions (wheels) for inlinehashes 0.0.5
File Interpreter ABI Platform
inlinehashes-0.0.5-py3-none-any.whl Python 3 none any Details

Total release size: 14.6 kB

Release files / inlinehashes-0.0.5.tar.gz

Download URL inlinehashes-0.0.5.tar.gz
Size 7.1 kB
Tags Source
SHA-256 checksum
How to use checksums
91319fc4e1765159c2510c078ed78745b63074a04afe2a7d4503cf7f0f6eea63
BLAKE2b-256 checksum
How to use checksums
0eb7fdced5a135bee493c11eabf3f7f6a87ab0945cebe4aadc97875e51c95e8f
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via poetry/1.3.2 CPython/3.10.6 Linux/5.15.0-56-generic

Release files / inlinehashes-0.0.5-py3-none-any.whl

Download URL inlinehashes-0.0.5-py3-none-any.whl
Size 7.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
399abcc2f7893b4f5f89554de7db956edd5f114113aa8591ab269abde1df0147
BLAKE2b-256 checksum
How to use checksums
84c1ea1f0343534c07f20700ad14030a64a78974f7619f261e2f563119d1e7e7
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
No
Uploaded via poetry/1.3.2 CPython/3.10.6 Linux/5.15.0-56-generic

Release history Release notifications | RSS feed

This release

0.0.5 This release

2 release files

0.0.4

2 release files

0.0.3

2 release files

0.0.2

2 release files

0.0.1

2 release files

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page