fork/cellxgene
1
0
Fork 0
mirror of https://github.com/chanzuckerberg/cellxgene.git synced 2026-10-08 02:58:12 +08:00
Code Issues Packages Projects Releases Wiki Activity

Remove hash source from CSP style-src directive (#1717)

Browse Source 
* remove style csp hash generation + lint

* remove references to style_hashes
This commit is contained in:
Severiano Badajoz
2020-08-05 16:43:35 -07:00
committed by GitHub
parent b18f96da77
commit 8d96477fae
2 changed files with 20 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/configuration/webpack/cspHashPlugin.js
+12 -20
View File
@@ -1,7 +1,12 @@
/* eslint-disable import/no-extraneous-dependencies -- this file is a devDependency*/
const cheerio = require("cheerio"); const cheerio = require("cheerio");
const crypto = require("crypto"); const crypto = require("crypto");
HtmlWebpackPlugin = require("html-webpack-plugin"); const HtmlWebpackPlugin = require("html-webpack-plugin");
const digest = (str) => {
const hash = crypto.createHash("sha256").update(str, "utf8").digest("base64");
return `sha256-${hash}`;
};
class CspHashPlugin { class CspHashPlugin {
constructor(opts) { constructor(opts) {
this.opts = { ...opts }; this.opts = { ...opts };
@@ -19,10 +24,7 @@ class CspHashPlugin {
if (filename) { if (filename) {
const results = {}; const results = {};
results["script-hashes"] = $("script:not([src]):not([no-csp-hash])") results["script-hashes"] = $("script:not([src]):not([no-csp-hash])")
.map((i, elmt) => this.digest($(elmt).html())) .map((i, elmt) => digest($(elmt).html()))
.get();
results["style-hashes"] = $("style:not([href]):not([no-csp-hash])")
.map((i, elmt) => this.digest($(elmt).html()))
.get(); .get();
const json = JSON.stringify(results); const json = JSON.stringify(results);
@@ -34,13 +36,10 @@ class CspHashPlugin {
// Remove no-csp-hash attributes. Cheerio does not parse Jinja templates // Remove no-csp-hash attributes. Cheerio does not parse Jinja templates
// correctly, so we brute force this with a regular expression. // correctly, so we brute force this with a regular expression.
data.html = data.html data.html = data.html.replace(
.replace(/(<script .*)no-csp-hash(.*>)/, (match, p1, p2) => /(<script .*)no-csp-hash(.*>)/,
[p1, p2].join("") (match, p1, p2) => [p1, p2].join("")
) );
.replace(/(<style .*)no-csp-hash(.*>)/, (match, p1, p2) =>
[p1, p2].join("")
);
// Tell webpack to move on // Tell webpack to move on
cb(null, data); cb(null, data);
@@ -48,14 +47,7 @@ class CspHashPlugin {
); );
}); });
} }
digest(str) {
const hash = crypto
.createHash("sha256")
.update(str, "utf8")
.digest("base64");
return `sha256-${hash}`;
}
} }
module.exports = CspHashPlugin; module.exports = CspHashPlugin;
/* eslint-enable import/no-extraneous-dependencies -- enable*/
server/eb/app.py
+8 -10
View File
@@ -94,13 +94,13 @@ class WSGIServer(Server):
@staticmethod @staticmethod
def _before_adding_routes(app, app_config): def _before_adding_routes(app, app_config):
script_hashes, style_hashes = WSGIServer.get_csp_hashes(app, app_config) script_hashes = WSGIServer.get_csp_hashes(app, app_config)
server_config = app_config.server_config server_config = app_config.server_config
csp = { csp = {
"default-src": ["'self'"], "default-src": ["'self'"],
"connect-src": ["'self'"], "connect-src": ["'self'"],
"script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + script_hashes, "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + script_hashes,
"style-src": ["'self'", "'unsafe-inline'"] + style_hashes, "style-src": ["'self'", "'unsafe-inline'"],
"img-src": ["'self'", "data:"], "img-src": ["'self'", "data:"],
"object-src": ["'none'"], "object-src": ["'none'"],
"base-uri": ["'none'"], "base-uri": ["'none'"],
@@ -131,15 +131,13 @@ class WSGIServer(Server):
if not isinstance(csp_hashes, dict): if not isinstance(csp_hashes, dict):
csp_hashes = {} csp_hashes = {}
script_hashes = [f"'{hash}'" for hash in csp_hashes.get("script-hashes", [])] script_hashes = [f"'{hash}'" for hash in csp_hashes.get("script-hashes", [])]
style_hashes = [f"'{hash}'" for hash in csp_hashes.get("style-hashes", [])] if len(script_hashes) == 0:
if len(script_hashes) == 0 or len(style_hashes) == 0:
logging.error("Content security policy hashes are missing, falling back to unsafe-inline policy") logging.error("Content security policy hashes are missing, falling back to unsafe-inline policy")
return (script_hashes, style_hashes) return (script_hashes)
@staticmethod @staticmethod
def compute_inline_scp_hashes(app, app_config): def compute_inline_csp_hashes(app, app_config):
dataset_configs = [app_config.default_dataset_config] + list(app_config.dataroot_config.values()) dataset_configs = [app_config.default_dataset_config] + list(app_config.dataroot_config.values())
hashes = [] hashes = []
for dataset_config in dataset_configs: for dataset_config in dataset_configs:
@@ -156,9 +154,9 @@ class WSGIServer(Server):
@staticmethod @staticmethod
def get_csp_hashes(app, app_config): def get_csp_hashes(app, app_config):
script_hashes, style_hashes = WSGIServer.load_static_csp_hashes(app) script_hashes = WSGIServer.load_static_csp_hashes(app)
script_hashes += WSGIServer.compute_inline_scp_hashes(app, app_config) script_hashes += WSGIServer.compute_inline_csp_hashes(app, app_config)
return (script_hashes, style_hashes) return script_hashes
try: try: