Feature/add csp

bothub/authentication/authorization.py

@@ -1,4 +1,5 @@
 import logging
+import re
 
 from django.utils.translation import ugettext_lazy as _
 from bothub.utils import check_module_permission
@@ -95,6 +96,7 @@ def create_user(self, claims):
         # Override existing create_user method in OIDCAuthenticationBackend
         email = claims.get("email")
         username = self.get_username(claims)[:16]
+        username = re.sub("[^A-Za-z0-9]+", "", username)
         user = self.UserModel.objects.create_user(email, username)
 
         user.name = claims.get("name", "")

bothub/settings.py

@@ -94,6 +94,15 @@
     ELASTICSEARCH_LOGS_DELETE_AGE=(str, "90d"),
     ELASTICSEARCH_LOGS_ROLLOVER_AGE=(str, "1d"),
     ELASTICSEARCH_TIMESTAMP_PIPELINE_FIELD=(str, "created_at"),
+    CSP_DEFAULT_SRC=(tuple, "CSP_DEFAULT_SRC"),
+    CSP_FRAME_ANCESTORS=(tuple, "CSP_FRAME_ANCESTORS"),
+    CSP_FONT_SRC=(tuple, "CSP_FONT_SRC"),
+    CSP_STYLE_SRC=(tuple, "CSP_STYLE_SRC"),
+    CSP_STYLE_SRC_ELEM=(tuple, "CSP_STYLE_SRC_ELEM"),
+    CSP_SCRIPT_SRC=(tuple, "CSP_SCRIPT_SRC"),
+    CSP_SCRIPT_SRC_ELEM=(tuple, "CSP_SCRIPT_SRC_ELEM"),
+    CSP_FRAME_SRC=(tuple, "CSP_FRAME_SRC"),
+    CSP_CONNECT_SRC=(tuple, "CSP_CONNECT_SRC"),
 )
 
 # Build paths inside the project like this: os.path.join(BASE_DIR, ...)
@@ -146,12 +155,12 @@
     "whitenoise.middleware.WhiteNoiseMiddleware",
     "django.contrib.sessions.middleware.SessionMiddleware",
     "django.middleware.locale.LocaleMiddleware",
+    "csp.middleware.CSPMiddleware",
     "corsheaders.middleware.CorsMiddleware",
     "django.middleware.common.CommonMiddleware",
     "django.middleware.csrf.CsrfViewMiddleware",
     "django.contrib.auth.middleware.AuthenticationMiddleware",
     "django.contrib.messages.middleware.MessageMiddleware",
-    "django.middleware.clickjacking.XFrameOptionsMiddleware",
     "bothub.api.v2.middleware.UserLanguageMiddleware",
 ]
 
@@ -301,6 +310,23 @@
 CSRF_COOKIE_SECURE = env.bool("CSRF_COOKIE_SECURE")
 
 
+# CSP headers
+
+CSP_DEFAULT_SRC = env.tuple("CSP_DEFAULT_SRC", default=("'self'",))
+CSP_FRAME_ANCESTORS = env.tuple("CSP_FRAME_ANCESTORS", default=("'self'", "*.weni.ai"))
+CSP_FONT_SRC = env.tuple("CSP_FONT_SRC", default=CSP_DEFAULT_SRC)
+CSP_STYLE_SRC = env.tuple(
+    "CSP_STYLE_SRC", default=("'self'", "'unsafe-inline'", "'unsafe-eval'")
+)
+CSP_STYLE_SRC_ELEM = env.tuple("CSP_STYLE_SRC_ELEM", default=CSP_STYLE_SRC)
+CSP_SCRIPT_SRC = env.tuple(
+    "CSP_SCRIPT_SRC", default=("'self'", "'unsafe-inline'", "'unsafe-eval'")
+)
+CSP_SCRIPT_SRC_ELEM = env.tuple("CSP_SCRIPT_SRC_ELEM", default=CSP_SCRIPT_SRC)
+CSP_FRAME_SRC = env.tuple("CSP_FRAME_SRC", default=CSP_DEFAULT_SRC)
+CSP_CONNECT_SRC = env.tuple("CSP_CONNECT_SRC", default=CSP_DEFAULT_SRC)
+
+
 # Logging
 
 LOGGING = DEFAULT_LOGGING

pyproject.toml

@@ -52,6 +52,7 @@ psycopg2-binary = "~=2.9.1"
 weni-protobuffers = "~=1.2.1"
 black = "21.7b0"
 Pillow = "~=8.4.0"
+django-csp = "^3.7"
 
 [tool.poetry.dev-dependencies]
 flake8 = "~=4.0.0"