From: Dylan William Hardison Date: Wed, 21 Feb 2018 18:59:53 +0000 (-0500) Subject: Bug 1439797 - Enable reporting-only CSP by default X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d435e0a5b0e07c145f929457313d8d7738f42b14;p=thirdparty%2Fbugzilla.git Bug 1439797 - Enable reporting-only CSP by default --- diff --git a/Bugzilla/CGI.pm b/Bugzilla/CGI.pm index 35d6dd687..513d8c302 100644 --- a/Bugzilla/CGI.pm +++ b/Bugzilla/CGI.pm @@ -34,8 +34,9 @@ BEGIN { sub DEFAULT_CSP { my %policy = ( default_src => [ 'self' ], - script_src => [ 'self', 'unsafe-inline', 'unsafe-eval', 'https://www.google-analytics.com' ], - child_src => [ 'self', ], + script_src => [ 'self', 'nonce', 'unsafe-inline', 'https://www.google-analytics.com' ], + frame_src => [ 'none', ], + worker_src => [ 'none', ], img_src => [ 'self', 'https://secure.gravatar.com', 'https://www.google-analytics.com' ], style_src => [ 'self', 'unsafe-inline' ], object_src => [ 'none' ], @@ -45,7 +46,7 @@ sub DEFAULT_CSP { 'https://www.google.com/search' ], frame_ancestors => [ 'none' ], - disable => 1, + report_only => 1, ); if (Bugzilla->params->{github_client_id} && !Bugzilla->user->id) { push @{$policy{form_action}}, 'https://github.com/login/oauth/authorize', 'https://github.com/login'; @@ -68,11 +69,8 @@ sub SHOW_BUG_MODAL_CSP { # This is from extensions/OrangeFactor/web/js/orange_factor.js 'https://brasstacks.mozilla.com/orangefactor/api/count', ], - child_src => [ - 'self', - # This is for the socorro lens addon and is to be removed by Bug 1332016 - 'https://ashughes1.github.io/bugzilla-socorro-lens/chart.htm' - ], + frame_src => [ 'none', ], + worker_src => [ 'none', ], ); if (use_attachbase() && $bug_id) { my $attach_base = Bugzilla->localconfig->{'attachment_base'}; @@ -194,7 +192,7 @@ sub content_security_policy { require Bugzilla::CGI::ContentSecurityPolicy; if (%add_params || !$self->{Bugzilla_csp}) { my %params = DEFAULT_CSP; - delete $params{disable} if %add_params && !$add_params{disable}; + delete $params{report_only} if %add_params && !$add_params{report_only}; foreach my $key (keys %add_params) { if (defined $add_params{$key}) { $params{$key} = $add_params{$key}; diff --git a/Bugzilla/CGI/ContentSecurityPolicy.pm b/Bugzilla/CGI/ContentSecurityPolicy.pm index 88f2732bc..50a399cdc 100644 --- a/Bugzilla/CGI/ContentSecurityPolicy.pm +++ b/Bugzilla/CGI/ContentSecurityPolicy.pm @@ -34,10 +34,10 @@ my $REFERRER_KEYWORD = enum [qw( my @ALL_BOOL = qw( sandbox upgrade_insecure_requests ); my @ALL_SRC = qw( - default_src child_src connect_src + default_src worker_src connect_src font_src img_src media_src object_src script_src style_src - frame_ancestors form_action + frame_src frame_ancestors form_action ); has \@ALL_SRC => ( is => 'ro', isa => $SOURCE_LIST, predicate => 1 ); diff --git a/chart.cgi b/chart.cgi index 26f21c389..36357cb3c 100755 --- a/chart.cgi +++ b/chart.cgi @@ -51,6 +51,7 @@ local our $cgi = Bugzilla->cgi; local our $template = Bugzilla->template; local our $vars = {}; my $dbh = Bugzilla->dbh; +$cgi->content_security_policy(report_only => 0); my $user = Bugzilla->login(LOGIN_REQUIRED); diff --git a/extensions/BMO/template/en/default/account/create.html.tmpl b/extensions/BMO/template/en/default/account/create.html.tmpl index d29303104..10d5fb5c1 100644 --- a/extensions/BMO/template/en/default/account/create.html.tmpl +++ b/extensions/BMO/template/en/default/account/create.html.tmpl @@ -38,7 +38,7 @@ style_urls = [ 'extensions/BMO/web/styles/create_account.css' ] %] - @@ -200,7 +200,7 @@ function validateAndSubmit() { Calendar
- diff --git a/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl index 13620d1c4..eac24e53e 100644 --- a/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl +++ b/extensions/BMO/template/en/default/bug/create/create-creative.html.tmpl @@ -209,7 +209,7 @@ function toggleTypeOther(element) { Calendar
- diff --git a/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl index 942b37afa..d97d95b2a 100644 --- a/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl +++ b/extensions/BMO/template/en/default/bug/create/create-fsa-budget.html.tmpl @@ -139,7 +139,7 @@ function validateAndSubmit() { Calendar
- diff --git a/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl b/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl index ab03523ae..841477099 100644 --- a/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl +++ b/extensions/BMO/template/en/default/bug/create/create-mozlist.html.tmpl @@ -16,7 +16,7 @@ style = ".mandatory{color:red;font-size:80%;}" %] - + : Enter the path to the file on your computer (or - paste text as attachment).
+ + paste text as attachment).
@@ -58,7 +67,7 @@

[%# Reset this whenever the page loads so that the JS state is up to date %] - diff --git a/template/en/default/attachment/edit.html.tmpl b/template/en/default/attachment/edit.html.tmpl index 43bf4c83c..d06d4ad56 100644 --- a/template/en/default/attachment/edit.html.tmpl +++ b/template/en/default/attachment/edit.html.tmpl @@ -219,7 +219,7 @@ View the attachment on a separate page. [% END %] -