Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

CSP security : Use report-uri directive to have more visibility on violations #2045

Merged
merged 2 commits into from
Aug 27, 2022
Merged

CSP security : Use report-uri directive to have more visibility on violations #2045

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
e2f26fe
Utiliser la directive CSP "report-uri" pour avoir de la visibilité su…
BadWolf42 Aug 19, 2022
fbf4d2f
Log Content Security Policy violation as a javascript error in Jeedom
BadWolf42 Aug 27, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
11 changes: 11 additions & 0 deletions desktop/common/js/utils.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,17 @@ window.addEventListener('error', function(event) {
$('#bt_jsErrorModal').show()
$.hideLoading()
})
window.addEventListener("securitypolicyviolation", function(event) {
var uri = event.blockedURI;
var violation = event.originalPolicy.trim().split(';').find(e => e.trim().startsWith(event.violatedDirective)).trim();
if (event.disposition == 'enforce')
var msg = `{{Impossible de charger la ressource "${uri}", car elle va contre la directive de Content Security Policy :<br /> "${violation}"}}`;
else
var msg = `{{La ressource "${uri}" a été chargée, mais elle va contre la directive de Content Security Policy :<br /> "${violation}"}}`;
JS_ERROR.push({"filename": event.documentURI, "lineno": "0", "message": msg});
$('#bt_jsErrorModal').show();
$.hideLoading();
});

//UI Time display:
setInterval(function() {
Expand Down
4 changes: 2 additions & 2 deletions desktop/php/system.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,8 +33,8 @@
<li class="cursor list-group-item list-group-item-success"><a class="bt_systemCommand" data-command="w">w</a></li>
<li class="cursor list-group-item list-group-item-success"><a class="bt_systemCommand" data-command="dpkg -l">dpkg -l</a></li>
<li class="cursor list-group-item list-group-item-success"><a class="bt_systemCommand" data-command="netstat -tupln"> netstat -tupln</a></li>
<li class="cursor list-group-item list-group-item-success"><a class="bt_systemCommand" data-command='sudo cp /var/www/html/install/apache_security_unsecure /etc/apache2/conf-available/security.conf;echo "systemctl restart apache2" | sudo at now'> {{Apache non securisé}}</a></li>
<li class="cursor list-group-item list-group-item-success"><a class="bt_systemCommand" data-command='sudo cp /var/www/html/install/apache_security /etc/apache2/conf-available/security.conf;echo "systemctl restart apache2" | sudo at now'> {{Apache sécurisé}}</a></li>
<li class="cursor list-group-item list-group-item-success"><a class="bt_systemCommand" data-command='sudo cp /var/www/html/install/apache_security_unsecure /etc/apache2/conf-available/security.conf;sudo a2enmod headers;echo "systemctl restart apache2" | sudo at now'> {{Apache non securisé}}</a></li>
<li class="cursor list-group-item list-group-item-success"><a class="bt_systemCommand" data-command='sudo cp /var/www/html/install/apache_security /etc/apache2/conf-available/security.conf;sudo a2enmod headers;echo "systemctl restart apache2" | sudo at now'> {{Apache sécurisé}}</a></li>
</ul>
</div>
</div>
Expand Down
2 changes: 1 addition & 1 deletion install/apache_security
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,6 @@ Header set X-Frame-Options "sameorigin"
Header set X-XSS-Protection "1; mode=block"
Header unset X-Powered-By
Header set Referrer-Policy: strict-origin-when-cross-origin
Header set Permissions-Policy "accelerometer=(),battery=(),fullscreen=(self),geolocation=(), camera=(),ambient-light-sensor=(self), autoplay=(self)"
Header set Permissions-Policy "accelerometer=(),battery=(),fullscreen=(self),geolocation=(),camera=(),ambient-light-sensor=(self),autoplay=(self)"
Header set Content-Security-Policy "default-src 'self' file: data: blob: filesystem:;script-src-attr 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.google.fr;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.google.fr;script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.google.fr;img-src 'self' *.jeedom.com *.google.com *.google.fr data:;style-src 'self' 'unsafe-inline';style-src-attr 'self' 'unsafe-inline';worker-src blob:;frame-src 'self' *.jeedom.com *.google.com *.google.fr data:;"
</IfModule>
12 changes: 11 additions & 1 deletion install/apache_security_unsecure
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,14 @@
<Directory /var/www/html>
Options -Indexes -ExecCGI -FollowSymLinks
AllowOverride All
</Directory>
</Directory>

<IfModule mod_headers.c>
Header set X-Content-Type-Options "nosniff"
Header set X-Frame-Options "sameorigin"
Header set X-XSS-Protection "1; mode=block"
Header unset X-Powered-By
Header set Referrer-Policy: strict-origin-when-cross-origin
Header set Permissions-Policy "accelerometer=(),battery=(),fullscreen=(self),geolocation=(),camera=(),ambient-light-sensor=(self),autoplay=(self)"
Header set Content-Security-Policy-Report-Only "default-src 'self' file: data: blob: filesystem:;script-src-attr 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.google.fr;script-src 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.google.fr;script-src-elem 'self' 'unsafe-inline' 'unsafe-eval' *.google.com *.google.fr;img-src 'self' *.jeedom.com *.google.com *.google.fr data:;style-src 'self' 'unsafe-inline';style-src-attr 'self' 'unsafe-inline';worker-src blob:;frame-src 'self' *.jeedom.com *.google.com *.google.fr data:;"
</IfModule>
7 changes: 7 additions & 0 deletions install/update/4.3.0.php
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
<?php
require_once __DIR__ . '/../../core/php/core.inc.php';

echo 'Ensure Content-Security-Policy (Report-Only) is enabled in apache';
shell_exec('sudo a2enmod headers');
shell_exec('grep -c "Content-Security-Policy" /etc/apache2/conf-available/security.conf > /dev/null 2>&1 || sudo cp /var/www/html/install/apache_security_unsecure /etc/apache2/conf-available/security.conf');
shell_exec('echo "systemctl restart apache2" | sudo at now');