darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-09-11 10:28:41 -04:00
Code Issues Packages Projects Releases Wiki Activity

Use csp nonces for inline scripts and styles

Browse Source
This commit is contained in:
Ryan Ahearn
2023-03-08 08:29:19 -05:00
parent e8e8c889d6
commit 2a6bc62003
5 changed files with 14 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
app/__init__.py
+1 -1
View File
@@ -30,7 +30,6 @@ from notifications_utils.formatters import (
get_lines_with_normalised_whitespace, get_lines_with_normalised_whitespace,
) )
from notifications_utils.recipients import format_phone_number_human_readable from notifications_utils.recipients import format_phone_number_human_readable
from notifications_utils.sanitise_text import SanitiseASCII
from werkzeug.exceptions import HTTPException as WerkzeugHTTPException from werkzeug.exceptions import HTTPException as WerkzeugHTTPException
from werkzeug.exceptions import abort from werkzeug.exceptions import abort
from werkzeug.local import LocalProxy from werkzeug.local import LocalProxy
@@ -147,6 +146,7 @@ navigation = {
'org_navigation': OrgNavigation(), 'org_navigation': OrgNavigation(),
} }
def _csp(config): def _csp(config):
asset_domain = config['ASSET_DOMAIN'] asset_domain = config['ASSET_DOMAIN']
logo_domain = config['LOGO_CDN_DOMAIN'] logo_domain = config['LOGO_CDN_DOMAIN']
app/templates/admin_template.html
+1 -1
View File
@@ -19,7 +19,7 @@
<link rel="stylesheet" media="print" href="{{ asset_url('stylesheets/print.css') }}" /> <link rel="stylesheet" media="print" href="{{ asset_url('stylesheets/print.css') }}" />
{% block extra_stylesheets %} {% block extra_stylesheets %}
{% endblock %} {% endblock %}
<style> <style nonce="{{ csp_nonce() }}">
.govuk-header__container { border-color: {{header_colour}} } .govuk-header__container { border-color: {{header_colour}} }
</style> </style>
{% if g.hide_from_search_engines %} {% if g.hide_from_search_engines %}
app/templates/main_template.html
+1 -1
View File
@@ -28,7 +28,7 @@
<!-- <meta property="og:image" content="{{ assetUrl | default('/assets') }}/images/govuk-opengraph-image.png"> --> <!-- <meta property="og:image" content="{{ assetUrl | default('/assets') }}/images/govuk-opengraph-image.png"> -->
</head> </head>
<body class="govuk-template__body {{ bodyClasses }}"> <body class="govuk-template__body {{ bodyClasses }}">
<script>document.body.className = ((document.body.className) ? document.body.className + ' js-enabled' : 'js-enabled');</script> <script nonce="{{ csp_nonce() }}">document.body.className = ((document.body.className) ? document.body.className + ' js-enabled' : 'js-enabled');</script>
{% block bodyStart %}{% endblock %} {% block bodyStart %}{% endblock %}
{% block skipLink %} {% block skipLink %}
app/templates/partials/tour.html
+1 -1
View File
@@ -4,7 +4,7 @@
<p class="heading-medium">Try sending yourself this example</p> <p class="heading-medium">Try sending yourself this example</p>
<div class="govuk-grid-row bottom-gutter {% if help != '1' %}greyed-out-step{% endif %}"> <div class="govuk-grid-row bottom-gutter {% if help != '1' %}greyed-out-step{% endif %}">
<div class="govuk-grid-column-one-sixth"> <div class="govuk-grid-column-one-sixth">
<p class="heading-large" style="float: left;">1.</p> <p class="heading-large">1.</p>
</div> </div>
<div class="govuk-grid-column-five-sixths"> <div class="govuk-grid-column-five-sixths">
<p class="govuk-body"> <p class="govuk-body">
tests/app/main/views/test_headers.py
+10 -9
View File
@@ -1,3 +1,4 @@
from re import search
def test_owasp_useful_headers_set( def test_owasp_useful_headers_set(
@@ -11,13 +12,13 @@ def test_owasp_useful_headers_set(
assert response.headers['X-Frame-Options'] == 'deny' assert response.headers['X-Frame-Options'] == 'deny'
assert response.headers['X-Content-Type-Options'] == 'nosniff' assert response.headers['X-Content-Type-Options'] == 'nosniff'
assert response.headers['X-XSS-Protection'] == '1; mode=block' assert response.headers['X-XSS-Protection'] == '1; mode=block'
assert response.headers['Content-Security-Policy'] == ( csp = response.headers['Content-Security-Policy']
"default-src 'self' static.example.com; " assert search(r"default-src 'self' static\.example\.com;", csp)
"script-src 'self' static.example.com *.google-analytics.com https://js-agent.newrelic.com " assert search(
"https://*.nr-data.net data:; " r"script-src 'self' 'unsafe-eval' static\.example\.com \*\.google-analytics\.com https:\/\/js-agent\.newrelic\.com https:\/\/\*\.nr-data\.net data: 'nonce-.*';", # noqa e501
"connect-src 'self' *.google-analytics.com https://*.nr-data.net; " csp
"font-src 'self' static.example.com data:; "
"img-src "
"'self' static.example.com static-logos.test.com"
" *.google-analytics.com data:"
) )
assert search(r"connect-src 'self' \*\.google-analytics\.com https:\/\/\*.nr-data\.net;", csp)
assert search(r"style-src 'self' static\.example\.com 'nonce-.*';", csp)
assert search(r"font-src 'self' static\.example\.com data:;", csp)
assert search(r"img-src 'self' static\.example\.com static-logos\.test\.com \*\.google-analytics\.com data:", csp)