Content Security Policy

[rudolphfroger]

Subject: adjust themes to allow a sufficient strict Content-Security-Policy

Problem

• Settings a sufficiently strict Content-Security-Policy raises many blocked actions

Also see: https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

Procedure to reproduce the problem

Serving the generated HTML using a Content Security Policy header like below gives many exceptions:

Content-Security-Policy: "media-src 'self'; img-src 'self' data:; connect-src 'self'; child-src 'self'; style-src 'self'; default-src 'none'; font-src 'self'; script-src 'self'"

Expected results

I expected to be able to set a Content-Security-Policy header to protect the site against XSS and injection attacks.

Environment info

• OS: any
• Python version: n.a.
• Sphinx version:any

[shimizukawa]

@rudolphfroger I think you mentioned about HTTP header, however sphinx IS NOT a server application. Sphinx just generate html files. So I think there is nothing todo from sphinx side.

[rudolphfroger]

I understand that Sphinx won't be able to set an HTTP header. At the moment the inline Javascript in the Sphinx themes prevent anyone from setting a reasonable Content Security Policy header without breaking Sphinx functionality. Moving all inline Javascript and CSS into the separate JS and CSS files would enable people to serve Sphinx in a better secured setup.

[shimizukawa]

Thanks for your explanation. Indeed, current templates are not good.

[ghost]

I think you mentioned about HTTP header, however sphinx IS NOT a server application. Sphinx just generate html files. So I think there is nothing todo from sphinx side.

CSP can either be served via a header (i.e, via Apache) or put into a meta tag (i.e, in a Sphinx theme). The point of CSP is that it can be configured to disallow inline scripts/styles to prevent XSS/CSRF attacks so it is a Sphinx problem.

Currently the RTD theme sets DOCUMENTATION_OPTIONS expected by the basic theme (doctools, searchtools, etc.) by doing this:

    <script type="text/javascript">
        var DOCUMENTATION_OPTIONS = {
             URL_ROOT:'{{ url_root }}',
             VERSION:'{{ release|e }}',
             COLLAPSE_INDEX:false,
             FILE_SUFFIX:'{{ '' if no_search_suffix else file_suffix }}',
             HAS_SOURCE:  {{ has_source|lower }},
             SOURCELINK_SUFFIX: '{{ sourcelink_suffix }}'
         };
     </script>

IMO there should be a better way to set these properties than JavaScript, i.e through some type of middleware.

[tk0miya]

Fixed by #4295.
Thank you for reporting!

[jumarko]

Because of this issue I've updated my sphinx to 1.8.4 and it seems that the problem with DOCUMENTATION_OPTIONS is gone.
However, I got other errors when using the search box because of inlined scripts used in search.html

[Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-w90MR9FaEMvvIqq+E32iGfCOojWBnzSzADCmOrNSung64Inv9lUYU9aaA6pLc131GP294iM50jiiqfmP' https://js.stripe.com". Either the 'unsafe-inline' keyword, a hash ('sha256-Ia59rEZC7ZJO4TTGcWqtwZBVaOfxSvdArdpB0AaSzbk='), or a nonce ('nonce-...') is required to enable inline execution.

[Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-w90MR9FaEMvvIqq+E32iGfCOojWBnzSzADCmOrNSung64Inv9lUYU9aaA6pLc131GP294iM50jiiqfmP' https://js.stripe.com". Either the 'unsafe-inline' keyword, a hash ('sha256-p98tulYY6PuvLZreTlWz42v29aGELSPpkZGnACGsP28='), or a nonce ('nonce-...') is required to enable inline execution.

[Report Only] Refused to execute inline script because it violates the following Content Security Policy directive: "script-src 'self' 'nonce-w90MR9FaEMvvIqq+E32iGfCOojWBnzSzADCmOrNSung64Inv9lUYU9aaA6pLc131GP294iM50jiiqfmP' https://js.stripe.com". Either the 'unsafe-inline' keyword, a hash ('sha256-euFOlnAZ5DTyYbwKER1+neBcumHLVJsd7mDPngZMMbU='), or a nonce ('nonce-...') is required to enable inline execution.

[ghost]

As I understand it, the purpose of the original AJAX code is to defer loading searchindex.js because of its size. In 2019, it should be possible to use something like async or defer. Further, caching should not be a problem either, assuming a properly configured server (and many people are using Cloudflare anyway).

[ghost]

@jumarko I've opened a PR if you would like to pull it down and test it.