Remove hash source from CSP style-src directive (#1717)

* remove style csp hash generation + lint

* remove references to style_hashes

client/configuration/webpack/cspHashPlugin.js

@@ -1,7 +1,12 @@
+/* eslint-disable import/no-extraneous-dependencies -- this file is a devDependency*/
 const cheerio = require("cheerio");
 const crypto = require("crypto");
-HtmlWebpackPlugin = require("html-webpack-plugin");
+const HtmlWebpackPlugin = require("html-webpack-plugin");
 
+const digest = (str) => {
+  const hash = crypto.createHash("sha256").update(str, "utf8").digest("base64");
+  return `sha256-${hash}`;
+};
 class CspHashPlugin {
   constructor(opts) {
     this.opts = { ...opts };
@@ -19,10 +24,7 @@ class CspHashPlugin {
           if (filename) {
             const results = {};
             results["script-hashes"] = $("script:not([src]):not([no-csp-hash])")
-              .map((i, elmt) => this.digest($(elmt).html()))
-              .get();
-            results["style-hashes"] = $("style:not([href]):not([no-csp-hash])")
-              .map((i, elmt) => this.digest($(elmt).html()))
+              .map((i, elmt) => digest($(elmt).html()))
               .get();
 
             const json = JSON.stringify(results);
@@ -34,13 +36,10 @@ class CspHashPlugin {
 
           // Remove no-csp-hash attributes. Cheerio does not parse Jinja templates
           // correctly, so we brute force this with a regular expression.
-          data.html = data.html
-            .replace(/(<script .*)no-csp-hash(.*>)/, (match, p1, p2) =>
-              [p1, p2].join("")
-            )
-            .replace(/(<style .*)no-csp-hash(.*>)/, (match, p1, p2) =>
-              [p1, p2].join("")
-            );
+          data.html = data.html.replace(
+            /(<script .*)no-csp-hash(.*>)/,
+            (match, p1, p2) => [p1, p2].join("")
+          );
 
           // Tell webpack to move on
           cb(null, data);
@@ -48,14 +47,7 @@ class CspHashPlugin {
       );
     });
   }
-
-  digest(str) {
-    const hash = crypto
-      .createHash("sha256")
-      .update(str, "utf8")
-      .digest("base64");
-    return `sha256-${hash}`;
-  }
 }
 
 module.exports = CspHashPlugin;
+/* eslint-enable import/no-extraneous-dependencies -- enable*/

server/eb/app.py

@@ -94,13 +94,13 @@ class WSGIServer(Server):
 
     @staticmethod
     def _before_adding_routes(app, app_config):
-        script_hashes, style_hashes = WSGIServer.get_csp_hashes(app, app_config)
+        script_hashes = WSGIServer.get_csp_hashes(app, app_config)
         server_config = app_config.server_config
         csp = {
             "default-src": ["'self'"],
             "connect-src": ["'self'"],
             "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + script_hashes,
-            "style-src": ["'self'", "'unsafe-inline'"] + style_hashes,
+            "style-src": ["'self'", "'unsafe-inline'"],
             "img-src": ["'self'", "data:"],
             "object-src": ["'none'"],
             "base-uri": ["'none'"],
@@ -131,15 +131,13 @@ class WSGIServer(Server):
         if not isinstance(csp_hashes, dict):
             csp_hashes = {}
         script_hashes = [f"'{hash}'" for hash in csp_hashes.get("script-hashes", [])]
-        style_hashes = [f"'{hash}'" for hash in csp_hashes.get("style-hashes", [])]
-
-        if len(script_hashes) == 0 or len(style_hashes) == 0:
+        if len(script_hashes) == 0:
             logging.error("Content security policy hashes are missing, falling back to unsafe-inline policy")
 
-        return (script_hashes, style_hashes)
+        return (script_hashes)
 
     @staticmethod
-    def compute_inline_scp_hashes(app, app_config):
+    def compute_inline_csp_hashes(app, app_config):
         dataset_configs = [app_config.default_dataset_config] + list(app_config.dataroot_config.values())
         hashes = []
         for dataset_config in dataset_configs:
@@ -156,9 +154,9 @@ class WSGIServer(Server):
 
     @staticmethod
     def get_csp_hashes(app, app_config):
-        script_hashes, style_hashes = WSGIServer.load_static_csp_hashes(app)
-        script_hashes += WSGIServer.compute_inline_scp_hashes(app, app_config)
-        return (script_hashes, style_hashes)
+        script_hashes = WSGIServer.load_static_csp_hashes(app)
+        script_hashes += WSGIServer.compute_inline_csp_hashes(app, app_config)
+        return script_hashes
 
 
 try: