GSIP 227
Introduce content-security-policy headers to block browser use of inline style and inline JavaScript.
Jody Garnett
This proposal is a quality assurance target to be addressed over the course of several releases.
- Under Discussion
- In Progress
- Completed
- Rejected
- Deferred
A consistent theme of "Stored Cross-Site Scripting (XSS)" vulnerabilities being reported consist of an administrator providing content which is then tricked into executing as a JavaScript function. By introducing content-security-policy restrictions we can reduce the severity of this category of problems from Moderate.
-
Some of this work has already been started:
- StylePublisher
- Simple SVG Renderer
- WMS OpenLayers Format
- MapML HTML Page
- GWC Demos Page
- GWC Seed Form
- Wicket
-
Update the developers guide to encourage developers contributing HTML output to follow more secure coding practices:
-
Add a configurable content-security-policy header.
The default configuration is fine and all pages are configured to support CSP headers. If you are working with a community module or something that does not yet take these restrictions into account and administrator can add a CSP rule as shown below. The
TestWfsPostservlet shown below is no longer present in the codebase, so this is only an example.
No anticipated impact on backwards compatibility.
Administrator may configure a CSP rule if any problem is encountered with community module or similar.
Confirm with Steve that default functionality is “fine”, and regex is only required if user wants to allow something.
Steve: Yes, that is correct.
Project Steering Committee:
- Alessio Fabiani:
- Andrea Aime: +1
- Ian Turton:
- Jody Garnett: +1
- Jukka Rahkonen: +1
- Kevin Smith: +1
- Simone Giannecchini: +0
- Torben Barsballe: +1
- Nuno Oliveira:
- Peter Smythe: +1
Community support:
- Steve Ikeoka