[2.4.8][PaymentServices] PaymentServicesPaypal module triggers CSP violation if minicart is displayed in an area configured to not allow inline scripts

[gwharton]

Preconditions and environment

• 2.4.8 vanilla
• Test Data deployed

Steps to reproduce

Deploy 2.4.8 With Test Data

BACKEND

System -> Commerce Services Connector

• Start Setup
• Enter Sandbox Keys
• Enter Production Keys
• Select a Saas Project and a Test Data Scope
• Finish Services Connector Setup

Sales -> Payment Services

• Sandbox Onboarding
• Complete Sandbox Onboarding

Store -> Configuration -> Sales -> Payment Methods

• Payment Services -> General
• Enabled = YES

EITHER

1. Configure the checkout to show the minicart during checkout (as that area has inline scripts disabled out of the box) or
2. Setup CSP to disable inline scripts everywhere (not just during checkout)

What we are trying to achieve is to have the minicart displayed in an area where inline scripts are disabled.

We can achieve option 2 using the following patch which disables inline scripts for the whole of the frontend.

--- vendor/magento/module-csp/etc/config.orig.xml       2025-04-02 22:58:42.000000000 +0100
+++ vendor/magento/module-csp/etc/config.xml    2025-06-04 19:58:48.337817478 +0100
@@ -82,7 +82,7 @@
                     <scripts>
                         <policy_id>script-src</policy_id>
                         <self>1</self>
-                        <inline>1</inline>
+                        <inline>0</inline>
                         <eval>1</eval>
                         <dynamic>0</dynamic>
                     </scripts>

FRONTEND

Open up developer console Add item to cart

Expected result

No CSP Violations are reported

Actual result

Additional information

The problem occurs because the Paypal Payment Module file

vendor/magento/module-payment-services-paypal/view/frontend/templates/smart_buttons_minicart.phtml

outputs an inline script amongst the minicart data passed from the section load AJAX call.

/customer/section/load/?sections=cart&force_new_section_timestamp=false

This will fail unless the area in which it is called allows inline scripts. You can see the text of the inline script in the response to that AJAX call. See "extra_actions". "extra_actions" is where the Payment Services Smart button html content is returned, but even if all of the buttons are disabled, the inline script is still output in all cases.

Any page containing the minicart, which has inline scripts turned off for CSP will log this error, or to put it another way, anywhere where you want to display the minicart, you must enable "unsafe_inline".

Release note

No response

Triage and priority

• [ ] Severity: S0 - Affects critical data or functionality and leaves users without workaround.
• [ ] Severity: S1 - Affects critical data or functionality and forces users to employ a workaround.
• [ ] Severity: S2 - Affects non-critical data or functionality and forces users to employ a workaround.
• [ ] Severity: S3 - Affects non-critical data or functionality and does not force users to employ a workaround.
• [ ] Severity: S4 - Affects aesthetics, professional look and feel, “quality” or “usability”.

[m2-assistant[bot]]

Hi @gwharton. Thank you for your report. To speed up processing of this issue, make sure that the issue is reproducible on the vanilla Magento instance following Steps to reproduce.

• For more details, review the Magento Contributor Assistant documentation.
• Add a comment to assign the issue: @magento I am working on this
• To learn more about issue processing workflow, refer to the Code Contributions.

---

Join Magento Community Engineering Slack and ask your questions in #github channel. :warning: According to the Magento Contribution requirements, all issues must go through the Community Contributions Triage process. Community Contributions Triage is a public meeting. :clock10: You can find the schedule on the Magento Community Calendar page. :telephone_receiver: The triage of issues happens in the queue order. If you want to speed up the delivery of your contribution, join the Community Contributions Triage session to discuss the appropriate ticket.

[m2-assistant[bot]]

Hi @engcom-November. Thank you for working on this issue. In order to make sure that issue has enough information and ready for development, please read and check the following instruction: :point_down:

• [ ] 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).
• [ ] 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue.
• [ ] 3. Add Area: XXXXX label to the ticket, indicating the functional areas it may be related to.
• [ ] 4. Verify that the issue is reproducible on 2.4-develop branch
  Details

  - If the issue is reproducible on 2.4-develop branch, please, add the label Reproduced on 2.4.x.
  - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!
• [ ] 5. Add label Issue: Confirmed once verification is complete.
• [ ] 6. Make sure that automatic system confirms that report has been added to the backlog.

[m2-assistant[bot]]

Hi @engcom-Hotel. Thank you for working on this issue. In order to make sure that issue has enough information and ready for development, please read and check the following instruction: :point_down:

• [ ] 1. Verify that issue has all the required information. (Preconditions, Steps to reproduce, Expected result, Actual result).
• [ ] 2. Verify that issue has a meaningful description and provides enough information to reproduce the issue.
• [ ] 3. Add Area: XXXXX label to the ticket, indicating the functional areas it may be related to.
• [ ] 4. Verify that the issue is reproducible on 2.4-develop branch
  Details

  - If the issue is reproducible on 2.4-develop branch, please, add the label Reproduced on 2.4.x.
  - If the issue is not reproducible, add your comment that issue is not reproducible and close the issue and stop verification process here!
• [ ] 5. Add label Issue: Confirmed once verification is complete.
• [ ] 6. Make sure that automatic system confirms that report has been added to the backlog.

[engcom-Hotel]

Hello @gwharton,

Thanks for the report and collaboration!

We have tried to reproduce the issue in the latest development branch i.e. 2.4-develop and 2.4.8 version but it seems the issue is not reproducible for us.

Can you please share some screencast which helps us in issue reproduction.

Thanks

[gwharton]

Steps to Reproduce

Deploy Magento 2.4.8 Deploy Sample Data

Install Test Module. This module just enables the display of the minicart in the checkout pages. Source code here. https://github.com/gwharton/module-magento-github-39960

CONSOLE

composer require gwharton/module-magento-github-39960 dev-main
php bin/magento module:enable Gw_MagentoGithub39960
php bin/magento setup:upgrade
php bin/magento cache:flush

BACKEND

System -> Commerce Services Connector Start Setup Enter Sandbox Keys Enter Production Keys Select a Saas Project and a Test Data Scope Finish Services Connector Setup

Sales -> Payment Services Sandbox Onboarding Complete Sandbox Onboarding

Store -> Configuration -> Sales -> Payment Methods Payment Services -> General Enabled = YES

FRONTEND

Open up developer console

Go to any product page Add any item to cart Verify there are no CSP violations

Go to checkout Verify there are no CSP violations <--- FAILED

Screencast of the error. https://www.youtube.com/watch?v=nNstsXknn8M

[engcom-Hotel]

Hello @gwharton, Thanks for the detailed steps!

We are able to reproduce this issue. Please refer to the below screenshot:

Hence confirming the issue.

Thanks

[github-jira-sync-bot]

:white_check_mark: Jira issue https://jira.corp.adobe.com/browse/AC-15000 is successfully created for this GitHub issue.

[m2-assistant[bot]]

:white_check_mark: Confirmed by @engcom-Hotel. Thank you for verifying the issue.
Issue Available: @engcom-Hotel, You will be automatically unassigned. Contributors/Maintainers can claim this issue to continue. To reclaim and continue work, reassign the ticket to yourself.