From 28c9e600aa8ea4069b2cb4531ca0dbf108c4b9cb Mon Sep 17 00:00:00 2001 From: Dharini Jeeva Date: Tue, 12 Jul 2022 10:12:06 -0700 Subject: [PATCH] Update content security (#1173) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit * chore: 🤖 upgrade ember content security policy --- ui/admin/config/content-security-policy.js | 34 ++++++++++++++++++++++ ui/admin/config/environment.js | 31 -------------------- ui/admin/package.json | 2 +- yarn.lock | 15 ++++++---- 4 files changed, 44 insertions(+), 38 deletions(-) create mode 100644 ui/admin/config/content-security-policy.js diff --git a/ui/admin/config/content-security-policy.js b/ui/admin/config/content-security-policy.js new file mode 100644 index 000000000..66d9d644a --- /dev/null +++ b/ui/admin/config/content-security-policy.js @@ -0,0 +1,34 @@ +'use strict'; + +const API_HOST = process.env.API_HOST || ''; + +module.exports = function (environment) { + let policy = { + // Deny everything by default + 'default-src': ["'none'"], + 'script-src': ["'self'"], + 'frame-src': ["'self'"], + 'font-src': ["'self'"], + 'connect-src': ["'self'"], + 'img-src': ["'self'", 'data:'], + 'style-src': ["'self'"], + 'media-src': ["'self'"], + 'manifest-src': ["'self'"], + 'style-src-attr': ["'self'"], + }; + + // Unsafe policy is necessary in development and test environments, but should + // not be used in production. + if (environment === 'development') { + policy['script-src'].push("'unsafe-eval'"); + policy['style-src'].push("'unsafe-inline'"); + if (API_HOST) policy['connect-src'].push(API_HOST); + } + + return { + delivery: ['header'], + enabled: environment !== 'test', + policy, + reportOnly: false, + }; +}; diff --git a/ui/admin/config/environment.js b/ui/admin/config/environment.js index 24a23e43d..d198678ce 100644 --- a/ui/admin/config/environment.js +++ b/ui/admin/config/environment.js @@ -96,20 +96,6 @@ module.exports = function (environment) { }, }, - contentSecurityPolicyHeader: 'Content-Security-Policy', - contentSecurityPolicyMeta: true, - contentSecurityPolicy: { - 'default-src': ["'none'"], - 'script-src': ["'self'"], - 'frame-src': ["'self'"], - 'font-src': ["'self'"], - 'connect-src': ["'self'"], - 'img-src': ["'self'", 'data:'], - 'style-src': ["'self'"], - 'media-src': ["'self'"], - 'manifest-src': ["'self'"], - }, - 'ember-cli-mirage': { directory: '../../addons/api/mirage', }, @@ -117,13 +103,6 @@ module.exports = function (environment) { featureFlags: featureEditions[EDITION], }; - // Unsafe policy is necessary in development and test environments, but should - // not be used in production. - const enableUnsafeCSP = () => { - ENV.contentSecurityPolicy['script-src'].push("'unsafe-eval'"); - ENV.contentSecurityPolicy['style-src'].push("'unsafe-inline'"); - }; - if (environment === 'development') { // ENV.APP.LOG_RESOLVER = true; // ENV.APP.LOG_ACTIVE_GENERATION = true; @@ -141,13 +120,6 @@ module.exports = function (environment) { }, }; - enableUnsafeCSP(); - // TODO: should provide an env var to explicitly add a host to CSP - // at build time for any environment (not just development), - // rather than automatically include API_HOST. Changes to CSP should - // be explicit. - if (API_HOST) ENV.contentSecurityPolicy['connect-src'].push(API_HOST); - // Enable features in development ENV.featureFlags['ssh-target'] = false; } @@ -163,9 +135,6 @@ module.exports = function (environment) { ENV.APP.rootElement = '#ember-testing'; ENV.APP.autoboot = false; - // CSP breaks test coverage, so it is disabled in this environment - ENV.contentSecurityPolicyMeta = false; - // Notification timeout should be 0 for fast tests ENV.notifyTimeout = 0; ENV.enableConfirmService = false; diff --git a/ui/admin/package.json b/ui/admin/package.json index 97d16a596..9cee71337 100644 --- a/ui/admin/package.json +++ b/ui/admin/package.json @@ -56,7 +56,7 @@ "ember-cli-app-version": "^5.0.0", "ember-cli-babel": "^7.26.8", "ember-cli-code-coverage": "^1.0.3", - "ember-cli-content-security-policy": "^1.1.1", + "ember-cli-content-security-policy": "^2.0.3", "ember-cli-dependency-checker": "^3.2.0", "ember-cli-htmlbars": "^5.7.1", "ember-cli-inject-live-reload": "^2.1.0", diff --git a/yarn.lock b/yarn.lock index a5281a410..57c04fb2d 100644 --- a/yarn.lock +++ b/yarn.lock @@ -11957,13 +11957,16 @@ ember-cli-code-coverage@^1.0.3: node-dir "^0.1.17" walk-sync "^2.1.0" -ember-cli-content-security-policy@^1.1.1: - version "1.1.1" - resolved "https://registry.yarnpkg.com/ember-cli-content-security-policy/-/ember-cli-content-security-policy-1.1.1.tgz#7d91a695319d8f99c317f3a594fba77bbfedf6c7" - integrity sha512-QgGAFt1nmsb0qF2YXI5iSM7jJVb09R2hrfX7uR+kkXMb5VyNQXdo2ZlX/DuIbePQVY4q9THpRh8Yf0UHJNbvDQ== +ember-cli-content-security-policy@^2.0.3: + version "2.0.3" + resolved "https://registry.yarnpkg.com/ember-cli-content-security-policy/-/ember-cli-content-security-policy-2.0.3.tgz#833eca6be4d625f8b1b85cf5bad62544b535b483" + integrity sha512-tSGRbR2XiOjHk7oEH7LVF1y5S643rUEjl3mujI6EYPkrQbHaV0WdLyIWJkLvuP1KGnjBfvnLCyiKDFu6z2PjVg== dependencies: body-parser "^1.17.0" - chalk "^2.0.0" + chalk "^4.1.1" + debug "^4.3.1" + ember-cli-babel "^7.26.3" + ember-cli-version-checker "^5.0.2" ember-cli-dependency-checker@^3.2.0: version "3.2.0" @@ -12266,7 +12269,7 @@ ember-cli-version-checker@^4.1.0: semver "^6.3.0" silent-error "^1.1.1" -ember-cli-version-checker@^5.0.1, ember-cli-version-checker@^5.1.1, ember-cli-version-checker@^5.1.2: +ember-cli-version-checker@^5.0.1, ember-cli-version-checker@^5.0.2, ember-cli-version-checker@^5.1.1, ember-cli-version-checker@^5.1.2: version "5.1.2" resolved "https://registry.yarnpkg.com/ember-cli-version-checker/-/ember-cli-version-checker-5.1.2.tgz#649c7b6404902e3b3d69c396e054cea964911ab0" integrity sha512-rk7GY+FmLn/2e22HsZs0Ycrz8HQ1W3Fv+2TFOuEFW9optnDXDgkntPBIl6gact/LHsfBM5RKbM3dHsIIeLgl0Q==