Re-add CSP, use flask-talisman

ambuda/__init__.py

@@ -12,6 +12,7 @@
 from dotenv import load_dotenv
 from flask import Flask, session
 from flask_babel import Babel, Domain
+from flask_talisman import Talisman
 from sentry_sdk.integrations.flask import FlaskIntegration
 from sqlalchemy import exc
 
@@ -92,6 +93,23 @@ def create_app(config_env: str):
 
     app = Flask(__name__)
 
+    csp = {
+        "default-src": ["'self'"],
+        "script-src": [
+            "'self'",
+            "https://cdn.jsdelivr.net",
+            "https://www.google.com",
+            "https://www.gstatic.com",
+            "https://plausible.io",
+            "'unsafe-eval'",
+        ],
+        "frame-src": ["https://www.google.com"],
+        "img-src": ["'self'", "data:"],
+        "style-src": ["'self'", "'unsafe-inline'"],
+    }
+
+    Talisman(app, content_security_policy=csp, force_https=config_env != config.TESTING)
+
     # Config
     app.config.from_object(config_spec)
 

ambuda/static/js/main.js

@@ -6,6 +6,8 @@ import HamburgerButton from './hamburger-button';
 import HTMLPoller from './html-poller';
 import Reader from './reader';
 import Proofer from './proofer';
+import HamburgerButton from './hamburger-button';
+import ProofingCreatePoll from './proofing-create-poll';
 import SortableList from './sortable-list';
 
 window.addEventListener('alpine:init', () => {
@@ -18,4 +20,5 @@ window.addEventListener('alpine:init', () => {
 
 (() => {
   HamburgerButton.init();
+  ProofingCreatePoll.init();
 })();

ambuda/static/js/proofer.js

@@ -64,6 +64,8 @@ export default () => ({
     this.loadSettings();
     this.layoutClasses = this.getLayoutClasses();
 
+    const IMAGE_URL = JSON.parse(document.getElementById('image_url').innerText);
+
     // Set `imageZoom` only after the viewer is fully initialized.
     this.imageViewer = initializeImageViewer(IMAGE_URL);
     this.imageViewer.addHandler('open', () => {

ambuda/static/js/proofing-create-poll.js

@@ -0,0 +1,20 @@
+import { $, Server } from './core.ts';
+
+export default (() => {
+  // Polls for status on project creation. Used only on
+  // templates/proofing/create-project-post.html.
+  function init() {
+    const $el = document.getElementById('proofing_polling_task_id');
+    if (!$el) {
+      return;
+    }
+    const taskId = JSON.parse($el.innerText);
+    setInterval(() => {
+      Server.getText(`/proofing/status/${taskId}`, (text) => {
+        $('#progress').innerHTML = text;
+      });
+    }, 5000);
+  }
+
+  return { init };
+})();

ambuda/templates/header-main-footer.html

@@ -7,7 +7,7 @@
     <script defer src="https://cdn.jsdelivr.net/npm/@indic-transliteration/sanscript@1.2.7/sanscript.min.js"></script>
     {# Load scripts before Alpine so that our init hooks are properly set up. #}
     <script defer src="{{ asset('gen/main.js') }}"></script>
-    <script src="https://unpkg.com/alpinejs@3.10.3/dist/cdn.min.js" defer></script>
+    <script src="https://cdn.jsdelivr.net/npm/alpinejs@3.10.3/dist/cdn.min.js" defer></script>
 {% endblock %}
 
 

ambuda/templates/proofing/create-project-post.html

@@ -23,7 +23,4 @@ <h1>Create new project</h1>
 </div>
 </div>
 
-<script type="text/javascript">
-</script>
-
 {% endblock %}

ambuda/templates/proofing/pages/edit.html

@@ -82,7 +82,5 @@
 
 <script src="https://cdn.jsdelivr.net/npm/openseadragon@3.1/build/openseadragon/openseadragon.min.js"></script>
 {% set image_url = url_for("site.page_image", project_slug=project.slug, page_slug=cur.slug) %}
-<script type="text/javascript">
-const IMAGE_URL = "{{ image_url }}";
-</script>
+<script type="application/json" id="image_url">"{{ image_url }}"</script>
 {% endblock %}

requirements.txt

@@ -35,6 +35,7 @@ Flask-Babel==2.0.0
 Flask-Bcrypt==1.0.1
 Flask-Login==0.6.1
 Flask-Mail==0.9.1
+flask-talisman==1.0.0
 Flask-WTF==1.0.1
 fonttools==4.33.3
 gevent==21.12.0