Move CSP options to new platform #52698

eliperelman · 2019-12-10T21:32:45Z

Summary

Move CSP options from legacy into the new platform. This blocks being able to add the new rendering service in #52161.

Checklist

Use ~~strikethroughs~~ to remove checklist items you don't feel are applicable to this PR.

This was checked for cross-browser compatibility, including a check against IE11
~~Any text added follows EUI's writing guidelines, uses sentence case text and includes i18n support~~
Documentation was added for features that require explanation or tutorials
Unit or functional tests were updated or added to match the most common scenarios
~~This was checked for keyboard-only and screenreader accessibility~~

For maintainers

This was checked for breaking API changes and was labeled appropriately
This includes a feature addition or change that requires a release note and was labeled appropriately

Dev Docs

The default options used for managing Kibana's Content Security Policy have been moved into core for the new platform. Relevant items exposed from src/core/server include:

CspConfig: TypeScript class for generating CSP configuration. Will generate default configuration for any properties not specified in initialization.
CspConfig.DEFAULT: Default CSP configuration.
ICspConfig: Interface representing CSP configuration.

elasticmachine · 2019-12-10T21:32:48Z

Pinging @elastic/kibana-platform (Team:Platform)

x-pack/legacy/plugins/security/server/routes/api/v1/authenticate.js

src/legacy/ui/ui_render/ui_render_mixin.js

src/core/server/types.ts

.github/CODEOWNERS

src/legacy/ui/ui_render/ui_render_mixin.js

src/core/server/csp/csp.ts

src/legacy/server/config/schema.js

src/core/server/csp/csp.ts

src/core/server/plugins/plugin_context.ts

src/core/server/plugins/types.ts

joshdover

In the last iteration I looked at, directives was not part of the config, which I thought made sense. This revision has it back in the config, which is redundant with the csp.rules config option.

src/core/server/csp/config.ts

src/core/server/csp/types.ts

pgayvallet

LGTM

src/legacy/core_plugins/kibana/server/lib/csp_usage_collector/csp_collector.ts

src/core/server/server.api.md

src/core/server/csp/csp_config.ts

kobelb · 2019-12-13T16:29:35Z

src/core/server/csp/config.ts

+        `style-src 'unsafe-inline' 'self'`,
+      ],
+    }),
+    strict: schema.boolean({ defaultValue: true }),


We'll have to be careful when backporting this, as the default in 7.x is false

src/core/server/csp/config.ts

x-pack/legacy/plugins/security/index.js

joshdover

Platform changes LGTM, I'll defer to @elastic/kibana-security for the changes to their plugin.

kobelb

LGTM on green CI

elasticmachine · 2019-12-13T20:52:46Z

💚 Build Succeeded

continuous-integration/kibana-ci/pull-request
Commit: fd01be7

History

💔 Build #15498 failed 451da17
💚 Build #15492 succeeded b3ebf53
💚 Build #15360 succeeded b81a6f8
💔 Build #15355 failed b78c450
💔 Build #15328 failed 96ef590

To update your PR or re-run it, just comment with:
@elasticmachine merge upstream

jportner · 2019-12-13T21:43:42Z

src/core/server/csp/config.ts

+  // TODO: Move this to server.csp using config deprecations
+  // ? https://github.com/elastic/kibana/pull/52251
+  path: 'csp',


Regarding renaming the csp config key, I will handle this in another PR and make sure we reach consensus between the Platform and Security teams =)

eliperelman · 2019-12-13T21:56:59Z

Thanks for all the great reviews!

* Move CSP options to new platform * Expose SharedGlobalConfig from root * Derive CSP options from config * Consolidate CSP configuration with HTTP config * Fix outstanding config renames * Remove legacy CSP configuration calls, migrate to platform properties * Revise docs * Fix test from type change * Expose ICspConfig, consolidate and simplify CSP defaults access * Rebase and update docs * Remove legacy API from route definition params, review nits * Clean up config path usages for consistency * Regenerate docs

* Move CSP options to new platform (#52698) * Move CSP options to new platform * Expose SharedGlobalConfig from root * Derive CSP options from config * Consolidate CSP configuration with HTTP config * Fix outstanding config renames * Remove legacy CSP configuration calls, migrate to platform properties * Revise docs * Fix test from type change * Expose ICspConfig, consolidate and simplify CSP defaults access * Rebase and update docs * Remove legacy API from route definition params, review nits * Clean up config path usages for consistency * Regenerate docs * Test correct default value of csp.strict in 7.x

* Move CSP options to new platform * Expose SharedGlobalConfig from root * Derive CSP options from config * Consolidate CSP configuration with HTTP config * Fix outstanding config renames * Remove legacy CSP configuration calls, migrate to platform properties * Revise docs * Fix test from type change * Expose ICspConfig, consolidate and simplify CSP defaults access * Rebase and update docs * Remove legacy API from route definition params, review nits * Clean up config path usages for consistency * Regenerate docs

eliperelman added Team:Core Core services & architecture: plugins, logging, config, saved objects, http, ES client, i18n, etc Feature:New Platform release_note:plugin_api_changes Contains a Plugin API changes section for the breaking plugin API changes section. v8.0.0 v7.6.0 labels Dec 10, 2019

eliperelman self-assigned this Dec 10, 2019

eliperelman added this to Code review in kibana-core [DEPRECATED] via automation Dec 10, 2019

eliperelman moved this from Code review to In progress in kibana-core [DEPRECATED] Dec 10, 2019

eliperelman force-pushed the feature/np-csp branch from c1b20ce to 02d335a Compare December 10, 2019 21:44

pgayvallet reviewed Dec 10, 2019

View reviewed changes

x-pack/legacy/plugins/security/server/routes/api/v1/authenticate.js Outdated Show resolved Hide resolved

src/legacy/ui/ui_render/ui_render_mixin.js Outdated Show resolved Hide resolved

src/core/server/types.ts Outdated Show resolved Hide resolved

eliperelman force-pushed the feature/np-csp branch 3 times, most recently from 002df22 to 255a723 Compare December 11, 2019 16:14

eliperelman marked this pull request as ready for review December 11, 2019 16:21

eliperelman requested review from a team as code owners December 11, 2019 16:21

eliperelman moved this from In progress to Code review in kibana-core [DEPRECATED] Dec 11, 2019

eliperelman force-pushed the feature/np-csp branch from 08c6fb6 to 7ab6d99 Compare December 11, 2019 16:33

eliperelman requested a review from pgayvallet December 11, 2019 16:48

mshustov reviewed Dec 11, 2019

View reviewed changes

.github/CODEOWNERS Outdated Show resolved Hide resolved

joshdover reviewed Dec 11, 2019

View reviewed changes

src/legacy/ui/ui_render/ui_render_mixin.js Outdated Show resolved Hide resolved

src/core/server/csp/csp.ts Outdated Show resolved Hide resolved

src/legacy/server/config/schema.js Outdated Show resolved Hide resolved

src/core/server/csp/csp.ts Outdated Show resolved Hide resolved

mshustov reviewed Dec 11, 2019

View reviewed changes

src/core/server/plugins/plugin_context.ts Outdated Show resolved Hide resolved

mshustov reviewed Dec 12, 2019

View reviewed changes

src/core/server/plugins/types.ts Outdated Show resolved Hide resolved

eliperelman force-pushed the feature/np-csp branch 2 times, most recently from fe8af81 to 2d3d745 Compare December 12, 2019 18:49

eliperelman requested review from joshdover and mshustov December 12, 2019 18:50

mshustov mentioned this pull request Dec 12, 2019

Migrate CSP configuration #50644

Closed

3 tasks

joshdover previously requested changes Dec 12, 2019

View reviewed changes

src/core/server/csp/config.ts Outdated Show resolved Hide resolved

src/core/server/csp/types.ts Outdated Show resolved Hide resolved

eliperelman added 8 commits December 13, 2019 05:34

Derive CSP options from config

6b1f50f

Consolidate CSP configuration with HTTP config

6d46ff3

Fix outstanding config renames

0725c62

Remove legacy CSP configuration calls, migrate to platform properties

9601749

Revise docs

eb224e6

Fix test from type change

f6339cb

Expose ICspConfig, consolidate and simplify CSP defaults access

fd90dfe

Rebase and update docs

b81a6f8

eliperelman force-pushed the feature/np-csp branch from b78c450 to b81a6f8 Compare December 13, 2019 11:40

eliperelman requested a review from pgayvallet December 13, 2019 11:41

pgayvallet approved these changes Dec 13, 2019

View reviewed changes

kobelb self-requested a review December 13, 2019 15:49

kobelb reviewed Dec 13, 2019

View reviewed changes

eliperelman added 2 commits December 13, 2019 12:05

Remove legacy API from route definition params, review nits

b3ebf53

Clean up config path usages for consistency

451da17

joshdover approved these changes Dec 13, 2019

View reviewed changes

kobelb approved these changes Dec 13, 2019

View reviewed changes

Regenerate docs

fd01be7

jportner mentioned this pull request Dec 13, 2019

Harden default Kibana security headers #52809

Closed

jportner approved these changes Dec 13, 2019

View reviewed changes

eliperelman merged commit 614bde9 into elastic:master Dec 13, 2019

kibana-core [DEPRECATED] automation moved this from Code review to Needs Backport Dec 13, 2019

eliperelman mentioned this pull request Dec 13, 2019

[7.x] Move CSP options to new platform (#52698) #53049

Merged

eliperelman moved this from Needs Backport to Done (7.6) in kibana-core [DEPRECATED] Dec 16, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Move CSP options to new platform #52698

Move CSP options to new platform #52698

eliperelman commented Dec 10, 2019 •

edited

Loading

elasticmachine commented Dec 10, 2019

joshdover left a comment

pgayvallet left a comment

kobelb Dec 13, 2019

joshdover left a comment

kobelb left a comment

elasticmachine commented Dec 13, 2019

jportner Dec 13, 2019

eliperelman commented Dec 13, 2019

Move CSP options to new platform #52698

Move CSP options to new platform #52698

Conversation

eliperelman commented Dec 10, 2019 • edited Loading

Summary

Checklist

For maintainers

Dev Docs

elasticmachine commented Dec 10, 2019

joshdover left a comment

Choose a reason for hiding this comment

pgayvallet left a comment

Choose a reason for hiding this comment

kobelb Dec 13, 2019

Choose a reason for hiding this comment

joshdover left a comment

Choose a reason for hiding this comment

kobelb left a comment

Choose a reason for hiding this comment

elasticmachine commented Dec 13, 2019

💚 Build Succeeded

History

jportner Dec 13, 2019

Choose a reason for hiding this comment

eliperelman commented Dec 13, 2019

eliperelman commented Dec 10, 2019 •

edited

Loading