Implement Content Security Policy

[lmorchard]

CSP lets us tell the browser what we consider as valid resources to load for a page, restricting by domain & etc. We should implement this for our site.

[lmorchard]

See also: #889

[lmorchard]

Got this started in a branch, but still chasing down a CSP violation report. Everything on the site seems to work, but I can't figure out where this report is coming from. I have a hunch that it's mustache templates, which we don't pre-compile and thus invoke eval at runtime.

{
  "csp-report": {
    "line-number": 1,
    "blocked-uri": "self",
    "document-uri": "http:\/\/testpilot.dev:8000\/experiments\/universal-search",
    "script-sample": ";(function installGlobalHook(window) {\n\t...",
    "referrer": "",
    "source-file": "http:\/\/testpilot.dev:8000\/experiments\/universal-search",
    "original-policy": "img-src http:\/\/testpilot.dev:8000 http:\/\/*.mozilla.net https:\/\/*.mozilla.net http:\/\/*.mozilla.org https:\/\/*.mozilla.org http:\/\/*.gravatar.com https:\/\/*.gravatar.com http:\/\/*.google-analytics.com https:\/\/*.google-analytics.com https:\/\/ssl.gstatic.com\/; default-src http:\/\/testpilot.dev:8000; font-src http:\/\/testpilot.dev:8000 http:\/\/*.mozilla.net https:\/\/*.mozilla.net http:\/\/*.mozilla.org https:\/\/*.mozilla.org; style-src http:\/\/testpilot.dev:8000 'unsafe-inline' http:\/\/*.mozilla.org https:\/\/*.mozilla.org http:\/\/*.mozilla.net https:\/\/*.mozilla.net; script-src http:\/\/testpilot.dev:8000 'unsafe-eval' http:\/\/*.mozilla.org https:\/\/*.mozilla.org http:\/\/*.mozilla.net https:\/\/*.mozilla.net http:\/\/*.google-analytics.com https:\/\/*.google-analytics.com https:\/\/apis.google.com; report-uri http:\/\/testpilot.dev:8000\/__cspreport__",
    "violated-directive": "script-src http:\/\/testpilot.dev:8000 'unsafe-eval' http:\/\/*.mozilla.org https:\/\/*.mozilla.org http:\/\/*.mozilla.net https:\/\/*.mozilla.net http:\/\/*.google-analytics.com https:\/\/*.google-analytics.com https:\/\/apis.google.com"
  }
}

But if anyone has a better CSP hunch here, it would be welcome :)

[lmorchard]

Oh ho! Disabled all my add-ons except for Test Pilot, and the CSP violation went away. I remembered bug 615708 and how content injected by add-ons in affected. Thinking in that case, we'll need to be sure CSP violation reporting isn't turned on in prod so we don't get DDoS'd like AMO did at one point