{
  "id": 8139608,
  "title": "Bypassing a WAF and a CSP with Google Tag Manager: An Attacker’s Perspective and Remediation Advice",
  "url": "https://urgent.news/2026/09/18/bypassing-a-waf-and-a-csp-with-google-tag-manager-an-attackers",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-18T00:47:41.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/raxis/bypassing-a-waf-and-a-csp-with-google-tag-manager-an-attackers-perspective-and-remediation-advice-2pig"
  },
  "original_language": "en",
  "account": "During multiple penetration tests last year, the author observed that clients often set unsafe directives for Google Tag Manager to facilitate data collection via Google Analytics and third-party vendors. This issue was exacerbated by the fact that Google hosts malicious JavaScript from googletagmanager.com. The article explores how a Content-Security-Policy (CSP) may or may not block this type of functionality. The author highlights that a well-defined CSP can prevent reflected Cross-site Scripting (XSS) attacks by using a nonce, a server-generated random value that determines whether scripts are valid and can execute. However, implementing a CSP can be challenging due to the dynamic nature of third-party libraries and the complexities of cross-team communication and collaboration. The strict-dynamic directive, introduced in 2021, helps address these issues by propagating trust from a trusted script to any scripts it loads. This allows organizations to implement a CSP while still supporting modern JavaScript frameworks and third-party libraries. The author provides code snippets demonstrating the implementation of a CSP with a nonce and the strict-dynamic directive, showing how malicious scripts are blocked while native features of Google Tag Manager, such as the Custom HTML Tag, can still function.",
  "summary": "This blog was originally published by Ryan Chaplin on the Raxis blog February 10, 2026 During several penetration tests last year, I observed clients often set unsafe directives for Google Tag Manager usually to supplement data collection via Google Analytics and third-party vendors. Aside from the obvious problem of using unsafe directives, this threat was amplified since Google hosts malicious…",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}