feat: Implement CSP header (#1586)

* feat: First CSP config draft

* Remove redundant lines

* Install other CSP branches

* Add autoconfig to codecov ignore list

* Fix tests

* Allow socket connection for servers (generic)

* Allow web sockets too

* Merge branch 'development' into csp_header

* Reorder and remove report only line

* Add setup.py to codecov ignore

* Clean ignore list, remove redundant linters and custom installations

* Merge branch 'development' into csp_header

# Conflicts:
#	Pipfile.lock

* Refactor config

* Black

* Fix local config

* Compact

.codecov.yml

@@ -5,11 +5,7 @@ coverage:
 
 ignore:
   - "aimmo_setup.py"
-  - "all_tests.py"
   - "run.py"
-  - "docs/*"
-  - "docs/**/*"
-  - "docs/**/**/*"
   - "aimmo/static/*"
   - "aimmo/static/**/*"
   - "aimmo/static/**/**/*"
@@ -18,6 +14,8 @@ ignore:
   - "aimmo_runner/*"
   - "aimmo_runner/**/*"
   - "test_utils/*"
+  - "aimmo/autoconfig.py"
+  - "setup.py"
 
 comment:
   layout: "reach, diff, flags, files"

aimmo/autoconfig.py

@@ -1,5 +1,7 @@
 """aimmo autoconfig"""
 
+from .csp_config import CSP_CONFIG
+
 DEFAULT_SETTINGS = {"AUTOCONFIG_INDEX_VIEW": "aimmo/home", "STATIC_URL": "/static/"}
 
 SETTINGS = {
@@ -27,3 +29,5 @@
     ],
     "USE_TZ": True,
 }
+
+SETTINGS.update(CSP_CONFIG)

aimmo/csp_config.py

@@ -0,0 +1,28 @@
+"""CSP config"""
+
+from common.app_settings import domain, MODULE_NAME
+
+CSP_CONFIG = {
+    "CSP_DEFAULT_SRC": ("'self'",),
+    "CSP_IMG_SRC": (
+        f"{domain()}/static/",
+        "https://p.typekit.net/",
+    ),
+    "CSP_FONT_SRC": ("https://use.typekit.net/",),
+    "CSP_SCRIPT_SRC": (
+        "https://use.typekit.net/mrl4ieu.js",
+        "https://pyodide-cdn2.iodide.io/v0.15.0/full/",
+    ),
+    "CSP_CONNECT_SRC": (
+        "https://pyodide-cdn2.iodide.io/v0.15.0/full/",
+        f"wss://{MODULE_NAME}-aimmo.codeforlife.education/",
+        f"https://{MODULE_NAME}-aimmo.codeforlife.education/",
+    ),
+}
+
+if MODULE_NAME == "local":
+    CSP_CONFIG["CSP_CONNECT_SRC"] += (
+        "ws://localhost:*/",
+        "ws://*:*/socket.io/",
+        "http://*:*/socket.io/",
+    )

setup.py

@@ -30,6 +30,7 @@
         "hypothesis==5.41.3",
         "kubernetes==12.0.1",
         "cfl-common",
+        "django-csp==3.7",
     ],
     tests_require=["docker >= 3.5, < 3.6", "kubernetes == 5.0.0", "PyYAML == 5.4"],
     version=version,