darkhelm/notifications-admin
1
0
Fork 0
mirror of https://github.com/GSA/notifications-admin.git synced 2026-08-23 07:46:23 -04:00
Code Issues Packages Projects Releases Wiki Activity

Clean up CSP header, add Permissions-Policy header

Browse Source
This commit is contained in:
Ryan Ahearn
2023-04-19 15:34:38 -04:00
parent 73d27d9049
commit 679072dd1b
2 changed files with 27 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
app/__init__.py
View File

@@ -154,35 +154,27 @@ def _csp(config):
"'self'", "'self'",
asset_domain asset_domain
], ],
"frame-ancestors": "'none'",
"form-action": "'self'",
"script-src": [ "script-src": [
"'self'", "'self'",
"'unsafe-eval'",
asset_domain, asset_domain,
"*.google-analytics.com", "'unsafe-eval'",
"https://js-agent.newrelic.com", "https://js-agent.newrelic.com",
"https://*.nr-data.net", "https://gov-bam.nr-data.net",
"data:"
], ],
"connect-src": [ "connect-src": [
"'self'", "'self'",
"*.google-analytics.com", "https://gov-bam.nr-data.net"
"https://*.nr-data.net"
], ],
"style-src": [ "style-src": [
"'self'", "'self'",
asset_domain asset_domain
], ],
"font-src": [
"'self'",
asset_domain,
"data:"
],
"img-src": [ "img-src": [
"'self'", "'self'",
asset_domain, asset_domain,
logo_domain, logo_domain
"*.google-analytics.com",
"data:"
] ]
} }
@@ -245,6 +237,22 @@ def create_app(application):
application, application,
content_security_policy=_csp(application.config), content_security_policy=_csp(application.config),
content_security_policy_nonce_in=['style-src', 'script-src'], content_security_policy_nonce_in=['style-src', 'script-src'],
permissions_policy={
'accelerometer': '()',
'ambient-light-sensor': '()',
'autoplay': '()',
'battery': '()',
'camera': '()',
'document-domain': '()',
'geolocation': '()',
'gyroscope': '()',
'local-fonts': '()',
'magnetometer': '()',
'microphone': '()',
'midi': '()',
'payment': '()',
'screen-wake-lock': '()'
},
frame_options='deny', frame_options='deny',
force_https=(application.config['HTTP_PROTOCOL'] == 'https') force_https=(application.config['HTTP_PROTOCOL'] == 'https')
) )

9
tests/app/main/views/test_headers.py
View File

@@ -14,11 +14,12 @@ def test_owasp_useful_headers_set(
assert response.headers['X-XSS-Protection'] == '1; mode=block' assert response.headers['X-XSS-Protection'] == '1; mode=block'
csp = response.headers['Content-Security-Policy'] csp = response.headers['Content-Security-Policy']
assert search(r"default-src 'self' static\.example\.com;", csp) assert search(r"default-src 'self' static\.example\.com;", csp)
assert search(r"frame-ancestors 'none';", csp)
assert search(r"form-action 'self';", csp)
assert search( assert search(
r"script-src 'self' 'unsafe-eval' static\.example\.com \*\.google-analytics\.com https:\/\/js-agent\.newrelic\.com https:\/\/\*\.nr-data\.net data: 'nonce-.*';", # noqa e501 r"script-src 'self' static\.example\.com 'unsafe-eval' https:\/\/js-agent\.newrelic\.com https:\/\/gov-bam\.nr-data\.net 'nonce-.*';", # noqa e501
csp csp
) )
assert search(r"connect-src 'self' \*\.google-analytics\.com https:\/\/\*.nr-data\.net;", csp) assert search(r"connect-src 'self' https:\/\/gov-bam.nr-data\.net;", csp)
assert search(r"style-src 'self' static\.example\.com 'nonce-.*';", csp) assert search(r"style-src 'self' static\.example\.com 'nonce-.*';", csp)
assert search(r"font-src 'self' static\.example\.com data:;", csp) assert search(r"img-src 'self' static\.example\.com static-logos\.test\.com", csp)
assert search(r"img-src 'self' static\.example\.com static-logos\.test\.com \*\.google-analytics\.com data:", csp)