Allow AppFramework applications to specify a custom CSP header #13989

LukasReschke · 2015-02-09T15:44:24Z

This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from inline-CSS and allowed eval() in our JavaScript components.

Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers:

$response = new TemplateResponse('activity', 'list', []);
$csp = new ContentSecurityPolicy();
$csp->addAllowedScriptDomain('www.owncloud.org');
$response->setContentSecurityPolicy($csp);
return $response;

Fixes #11857 which is a pre-requisite for #13458 and #11925

@Raydiation Care to take a look at this? :)
@DeepDiver1975 You as well? – This is required in case we want to harden our CSP policy even further to allow applications such as documents to have some lightened rules. Might break one or two things but we will notice this fast and can port the specific controllers that break to use the AppFramework :-)

ghost · 2015-02-09T16:45:00Z

Refer to this link for build results (access rights to CI server needed):
https://ci.owncloud.org//job/pull-request-analyser-ng-simple/9070/
Test PASSed.

BernhardPosselt · 2015-02-15T16:34:02Z

Yes, the Response class seems indeed the right place to tackle it. As for the naming: *Helper is redundant. There are two ways to do it IMHO:

$csp = new OCP\AppFramework\Http\CSP();
$csp->allowImageSrc('some.domain.com');
$response = new Response();
$response->setCSP($csp);

$csp = 'some string with csp settings';
$response->setCSP($csp);
// or
$response->allowImageSrc('some.domain.com');

The second one is easier to use because you dont need to read up on how to use the CSP class but I think the first approach is the correct one because it is easier to set default values and allow users to overwrite safe defaults and prevent easy mistakes

For instance we never want the dev to set the complete csp string at once because he'll likely make a mistake.

Will review further later ;)

BernhardPosselt · 2015-02-15T17:06:46Z

lib/public/appframework/http/contentsecuritypolicyhelper.php

+	 * @param bool $state
+	 * @return $this
+	 */
+	public function inlineScriptState($state = false) {


Id use something that implies the boolean more, like allowInlineScript($enabled = false), same for the following methods

BernhardPosselt · 2015-02-15T17:12:58Z

Good idea and nicely executed, you're getting good at this ;)

LukasReschke · 2015-02-16T09:19:56Z

Thanks @Raydiation for reviewing. Much appreciated. I'll take a look at the comments today and incorporate them :)

This change allows AppFramework applications to specify a custom CSP header for example when the default policy is too strict. Furthermore this allows us to partially migrate away from CSS and allowed eval() in our JavaScript components. Legacy ownCloud components will still use the previous policy. Application developers can use this as following in their controllers: ```php $response = new TemplateResponse('activity', 'list', []); $cspHelper = new ContentSecurityPolicyHelper(); $cspHelper->addAllowedScriptDomain('www.owncloud.org'); $response->addHeader('Content-Security-Policy', $cspHelper->getPolicy()); return $response; ``` Fixes #11857 which is a pre-requisite for #13458 and #11925

DeepDiver1975 · 2015-02-16T10:12:18Z

config/config.sample.php

@@ -930,15 +930,6 @@
 ),

 /**
- * Custom CSP policy, changing this will overwrite the standard policy
- */
-'custom_csp_policy' =>


so - there is no need to configure this globally anymore?

I guess many installations out there already tweak this - e.g. to allow the installation to be iframed etc.

What's the migration path for such a scenario? @LukasReschke THX

I guess many installations out there already tweak this - e.g. to allow the installation to be iframed etc.

Iframing is defined by another policy ;-)

The thing that might break are people using inline JS for example for tracking using Piwik / Google Analytics. But honestly, if you do such stuff you should also know how to fix it yourself (as in: It does not make sense to ship insecure defaults because of those few people ;-)

Migration path: "Fix your blackmagic. This was anyways just a very ugly workaround in times where we didn't have the AppFramework and wanted apps to specify policies on their own."

Let's add it to https://github.com/owncloud/core/wiki/ownCloud-8.1-Features once merged.

ghost · 2015-02-16T10:28:08Z

Refer to this link for build results (access rights to CI server needed):
https://ci.owncloud.org//job/pull-request-analyser-ng-simple/9474/
Test PASSed.

LukasReschke · 2015-02-16T11:02:06Z

Analysis Tools Updated
Some analysis tools were updated to newer versions. This might result in changes which are unrelated to your code changes!
PHP Analyzer: 1.6.0 -> 1.6.1 (changelog)

🙈

BernhardPosselt · 2015-02-16T11:28:38Z

lib/public/appframework/http/contentsecuritypolicy.php

+	 * @param bool $state
+	 * @return $this
+	 */
+	public function evalScriptState($state = true) {


BernhardPosselt · 2015-02-16T11:30:54Z

lib/public/appframework/http/response.php


 		if($this->lastModified) {
 			$mergeWith['Last-Modified'] =
 				$this->lastModified->format(\DateTime::RFC2822);
 		}

+		// Build Content-Security-Policy and use default if none has been specified
+		if(is_null($this->contentSecurityPolicy)) {


This can be moved right up and you can get rid of the if with

private $contentSecurityPolicy = new ContentSecurityPolicy();

I don't think one can set expressions as default field value:

Parse error: syntax error, unexpected 'new' (T_NEW) in /Users/lreschke/Programming/core/lib/public/appframework/http/response.php on line 76

Hm, shitty php

BernhardPosselt · 2015-02-16T11:49:36Z

👍

scrutinizer-notifier · 2015-02-16T11:53:21Z

The inspection completed: 10 new issues, 44 updated code elements

ghost · 2015-02-16T12:02:15Z

Refer to this link for build results (access rights to CI server needed):
https://ci.owncloud.org//job/pull-request-analyser-ng-simple/9485/
Test PASSed.

th3fallen · 2015-02-18T15:27:27Z

works here 👍

Allow AppFramework applications to specify a custom CSP header

libasys · 2015-04-20T16:14:35Z

This is a nice feature, but i have a problem with "$allowedImageDomains", this checks the image source, but what happens if i work directly with the data like:

data:image/jpg;base64,/9j/4AA  ....

so the browser not load the image source but shows this error:
... because it violates the following Content Security Policy directive: "img-src 'self'"

so i have to set allowedImageDomains = '*' or is there are a other mechanism?

Thanks

LukasReschke · 2015-04-20T16:19:02Z

@libasys data: should help. – Untested.

libasys · 2015-04-20T16:28:54Z

I tested this and added following to the default behaviour of $allowedImageDomains on lib/public/appframework/http/contentsecuritypolicy.php

/** @var array Domains from which images can get loaded */
    private $allowedImageDomains = [
        '\'self\' data:',
    ];

This should be a default behaviour of $allowedImageDomains! Now it works as expected!

LukasReschke · 2015-04-20T16:34:30Z

This should be a default behaviour of $allowedImageDomains! Now it works as expected!

I'd like to prevent this. There are at the moment not much apps that need this behaviour. You can do this on single controllers like that:

$csp = new OCP\AppFramework\Http\ContentSecurityPolicy();
$csp->addAllowedImageDomain('data:');
$response = new TemplateResponse($this->appName, 'public', $shareTmpl, 'base');
$response->setContentSecurityPolicy($csp);
return $response;

libasys · 2015-04-20T16:42:39Z

perfect! It works! :) Thanks! Should become part of the devs manual on owncloud.org with an example.

LukasReschke · 2015-04-20T17:05:25Z

Yup. – I still need to do it for 8.1.

Ref owncloud-archive/documentation#876

LukasReschke added security enhancement 3 - To Review labels Feb 9, 2015

LukasReschke force-pushed the enhancment/security/11857 branch from 8d46df5 to be875ff Compare February 9, 2015 15:53

BernhardPosselt reviewed Feb 15, 2015
View reviewed changes

LukasReschke force-pushed the enhancment/security/11857 branch from be875ff to 34ea8ae Compare February 16, 2015 09:58

LukasReschke force-pushed the enhancment/security/11857 branch from 34ea8ae to b20174b Compare February 16, 2015 10:00

DeepDiver1975 reviewed Feb 16, 2015
View reviewed changes

BernhardPosselt reviewed Feb 16, 2015
View reviewed changes

Rename to allowEval

a9d1a01

BernhardPosselt reviewed Feb 16, 2015
View reviewed changes

LukasReschke mentioned this pull request Feb 17, 2015

EventSource fallback will not work with IE versions that support CSP #14286

Closed

th3fallen added a commit that referenced this pull request Feb 18, 2015

Merge pull request #13989 from owncloud/enhancment/security/11857

8d09cc3

Allow AppFramework applications to specify a custom CSP header

th3fallen merged commit 8d09cc3 into master Feb 18, 2015

LukasReschke deleted the enhancment/security/11857 branch February 18, 2015 15:29

LukasReschke restored the enhancment/security/11857 branch February 25, 2015 10:50

LukasReschke deleted the enhancment/security/11857 branch February 25, 2015 10:51

oparoz mentioned this pull request Mar 14, 2015

Content Security blocks galleryplus on latest git master of owncloud owncloud/gallery#89

Closed

MorrisJobke added this to the 8.1-current milestone Mar 16, 2015

LukasReschke mentioned this pull request Aug 10, 2015

Maps does not load map tiles because of Content Security Policy owncloud-archive/maps#47

Closed

4oo4 mentioned this pull request Jan 14, 2017

Nextcloud 11 Compatibility Fmstrat/ownnote#337

Closed

lock bot locked as resolved and limited conversation to collaborators Aug 12, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow AppFramework applications to specify a custom CSP header #13989

Allow AppFramework applications to specify a custom CSP header #13989

LukasReschke commented Feb 9, 2015

ghost commented Feb 9, 2015

BernhardPosselt commented Feb 15, 2015

BernhardPosselt Feb 15, 2015

BernhardPosselt commented Feb 15, 2015

LukasReschke commented Feb 16, 2015

DeepDiver1975 Feb 16, 2015

LukasReschke Feb 16, 2015

LukasReschke Feb 16, 2015

LukasReschke Feb 16, 2015

ghost commented Feb 16, 2015

LukasReschke commented Feb 16, 2015

BernhardPosselt Feb 16, 2015

BernhardPosselt Feb 16, 2015

LukasReschke Feb 16, 2015

BernhardPosselt Feb 16, 2015

BernhardPosselt commented Feb 16, 2015

scrutinizer-notifier commented Feb 16, 2015

ghost commented Feb 16, 2015

th3fallen commented Feb 18, 2015

libasys commented Apr 20, 2015

LukasReschke commented Apr 20, 2015

libasys commented Apr 20, 2015

LukasReschke commented Apr 20, 2015

libasys commented Apr 20, 2015

LukasReschke commented Apr 20, 2015

Allow AppFramework applications to specify a custom CSP header #13989

Allow AppFramework applications to specify a custom CSP header #13989

Conversation

LukasReschke commented Feb 9, 2015

ghost commented Feb 9, 2015

BernhardPosselt commented Feb 15, 2015

Choose a reason for hiding this comment

BernhardPosselt commented Feb 15, 2015

LukasReschke commented Feb 16, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

ghost commented Feb 16, 2015

LukasReschke commented Feb 16, 2015

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

BernhardPosselt commented Feb 16, 2015

scrutinizer-notifier commented Feb 16, 2015

ghost commented Feb 16, 2015

th3fallen commented Feb 18, 2015

libasys commented Apr 20, 2015

LukasReschke commented Apr 20, 2015

libasys commented Apr 20, 2015

LukasReschke commented Apr 20, 2015

libasys commented Apr 20, 2015

LukasReschke commented Apr 20, 2015