Add the ability to set Content Security Policies

[fritzmg]

This introduces the ability to define Content Security Policies for the front end. There will be new settings for each
website root:

Within the Content Security Policy field you can define your policies - with the exakt same syntax as the
Content-Security-Policy header. For example default-src 'self' will tell the browser to only accept resources from
the same domain and not allow any inline styles or scripts at all (at least not without nonces).

Once a policy for default-src, script-src or style-src is set [1], Contao will automatically generate nonces for
the respective <script> and <style> elements, at least in supported templates. If you have any custom templates
with these tags, then you will need to adjust your template to include the nonce, which is pretty simple:

<script nonce="{{ contao_csp_nonce('script-src') }}">

<script nonce="<?= $this->nonce('script-src') ?>">

In this PR the nonce attribute is added conditionally everywhere, i.e. the attribute will not be set, if no nonce was
necessary and thus no nonce was generated. So there will not be empty nonce attributes in the HTML code (though it
would be fine).

Allowing Specific Sources Dynamically

Some content elements like the video, YouTube and Vimeo players dynamically allow their respective sources. This can be
done directly from within the templates:

{% do add_csp_source('frame-src', iframe_attrs.src) %}

<?php $this->addCspSource('frame-src', $this->src); ?>

So even if you set the policies frame-src 'self'; media-src 'none' these content elements will still work as they
dynamically allow their specific sources.

Reporting

In the CSP spec you also have the possibility to set a reporting URL. If the browser detects a CSP violation it will
then automatically POST a report to that URL. Reporting needs to be specifically enabled in the website root. These reports will then also show up in the system log:

The system log entry will tell you which policy was violated and on which line. The detailed information will contain
the original URL of the violation.

This is of course a public API endpoint where anyone or anything can send any data. As such this needs to be handled
with care. This PR uses the ContentSecurityPolicyController of nelmio/security-bundle which has the ability to
filter out "noise". But instead of using that controller directly this PR implements its own controller and injects the service of Nelmio's controller. Our route always requires a valid page ID and always checks whether the current page's root has reporting enabled. If not, it will respond with 404 - otherwise it will forward the request to the ContentSecurityPolicyController of nelmio/security-bundle.

Twig Components

This PR introduces two new Twig components: _style and _script. When using them you do not have to think about having to check for nonces as the component does this automatically for you. However, I find that using these components makes the templates less readable - as there will also be no syntax highlighting by your editor anymore, since it won't know that the content of the component block is within a <script> or <style> tag.

Thoughts, Decisions, Caveats

Initially I thought may be Contao should set some sensible defaults automatically and also automatically allow the
staticFiles and staticPlugins domains. However, this approach can be difficult and flawed. Contao cannot know in
advance what kind of sources are hosted on its current and any of the static domains, thus we cannot set any -src
policies (we would have to set all of them). It needs to be solely up to the administrator to set appropriate policies.

One exception could be iframe sources, which could be automatically added (see above). However, allowing specific
sources dynamically also has a caveat. Let's take the YouTube content element for example: on the page where such a
content element is added, the Content-Security-Policy will automatically be the following [2]:

frame-src https://www.youtube.com/embed/abc123

However, this will also mean that no other iframes will be allowed on the same page, whereas without this content
element they would be. We could change the helper functions to not add the directive if no existing (or default-src
directive) is already present. Unfortunately the CSPBuilder has no such API at the moment.

Further comments about the code will be down below in threads. PR is still a draft due to missing tests.

Footnotes

• [1]: If you only set a default-src policy no nonces will be generated currently unfortunately due to an oversight
  in paragonie/csp-builder (see Generate nonce also when only default-src policy is applied paragonie/csp-builder#65) not relevant after overhaul
• [2]: Actually it will be only child-src without legacy browser support enabled
  (see un-deprecate frame-src paragonie/csp-builder#76) not relevant after overhaul

[leofeyer]

I stumbled upon two things:

---

The "Content Security Policy" field is not mandatory, yet if I leave it blank, nothing is applied. It should therefore be mandatory, shouldn‘t it?

---

The report in the system log has a strange URL that I cannot open and the page ID is 0. Is this intended?

[fritzmg]

The "Content Security Policy" field is not mandatory, yet if I leave it blank, nothing is applied. It should therefore be mandatory, shouldn‘t it?

Yeah, I think it would not hurt to make it mandatory.

The report in the system log has a strange URL that I cannot open and the page ID is 0. Is this intended?

The Page ID will always be 0, yes. The URL is the "source file" reported by the browser, but I suppose depending on the violation there could be no source file. We could change https://github.com/contao/contao/pull/6631/files#diff-2b3da269e425b96148c6bfa17b165cf8995271a73b8d8da0cb8d35f36c59040eR38 to fall back to the document URI instead (I think). I'll have a look.

[fritzmg]

The report in the system log has a strange URL that I cannot open and the page ID is 0. Is this intended?

The Page ID will always be 0, yes. The URL is the "source file" reported by the browser, but I suppose depending on the violation there could be no source file. We could change https://github.com/contao/contao/pull/6631/files#diff-2b3da269e425b96148c6bfa17b165cf8995271a73b8d8da0cb8d35f36c59040eR38 to fall back to the document URI instead (I think). I'll have a look.

Should be fixed in 8f892e0

[leofeyer]

Thank you @fritzmg.