CSP support: nonce for inline scripts and CspPolicy helper - #2
Merged
Conversation
Integrators embedding the snippet had to allow 'unsafe-inline' because getHTML() rendered a bare <script> tag, and they had no authoritative list of the directives the widget needs. - SnippetCode accepts an optional nonce and renders <script nonce="...">; getCode() and the no-nonce output are unchanged - The nonce is configured once on SnippetClient / SnippetClientFactory and propagates to every generated tag; NonceValidator rejects values outside the base64 alphabet with a CspException - CspPolicy derives script-src, connect-src, style-src, img-src and frame-src from the environment's loader URL and exposes them as an array, a ready header or a meta tag; SnippetClient::csp() pre-fills it with the client's environment and nonce
Deriving the API and application origins from the CDN hostname produced a silently wrong policy whenever the deployment did not follow the assumed host layout — the widget then breaks on a CSP block, which is miserable to debug. The layout also is not a rule: production needs www.<zone> while staging needs the bare <zone>. - OriginAwareEnvironmentInterface extends EnvironmentInterface with getApiUrl() and getApplicationUrl(); plain EnvironmentInterface implementations keep working - Environment carries the real values per case, CustomEnvironment takes them as optional constructor arguments - CspPolicy reads them from the environment or from its own apiUrl / applicationUrl arguments and throws a CspException naming the directive and the argument when neither knows them; only cdnOrigin is still read from the loader URL, which does contain it
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Řeší část stromcom/www.stromcom.cz#10 týkající se PHP balíčku.
Co přibylo
Nonce pro inline
<script>—SnippetCode::getHTML()dosud vracel<script>bez atributů, takže integrátor sscript-src 'self'musel mít'unsafe-inline'. Nonce se nastaví jednou naSnippetClient/SnippetClientFactory::create()a propíše se do všech generovanýchSnippetCode. Validace na jednom místě (NonceValidator), atribut escapovaný, nováCspException.CspPolicy— poskládá direktivy, které musí hostitelská stránka povolit:getDirectives(),getHeaderName(),getHeaderValue(),getMetaTag().SnippetClient::csp()vrátí politiku předdrátovanou environmentem a nonce klienta.OriginAwareEnvironmentInterface— rozšiřujeEnvironmentInterfaceogetApiUrl()agetApplicationUrl();Environmentenum nese reálné hodnoty,CustomEnvironmentje bere volitelně v konstruktoru. Když origin nikdo nedodá, letíCspException— origins se zásadně nehádají, protože špatný odhad by widget tiše zablokoval.Zpětná kompatibilita
EnvironmentInterfacebeze změny, nonce je poslední (volitelný) parametr, bez nonce je výstup bajt po bajtu stejný jako dosud — pokryto testem.Ověřeno
Seznam direktiv není odvozený od stolu — je ověřený Playwright testem proti stránce s reálně vynucenou striktní CSP (
default-src 'none'), včetně negativní kontroly, že test výpadek direktivy chytí.