Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

WriteFreely is not CSP friendly #332

Open
Crocmagnon opened this issue Jun 29, 2020 · 1 comment
Open

WriteFreely is not CSP friendly #332

Crocmagnon opened this issue Jun 29, 2020 · 1 comment

Comments

@Crocmagnon
Copy link

@Crocmagnon Crocmagnon commented Jun 29, 2020

Describe the bug

A strict Content-Security-Policy looks like this:

Content-Security-Policy: default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'

This prevents execution of inline scripts and styles which WriteFreely uses.

Steps to reproduce (if necessary)

  1. Setup writefreely
  2. Add custom CSS
  3. Configure the webserver (nginx/apache/...) to serve a Content-Security-Policy with the value default-src 'none'; img-src 'self'; script-src 'self'; style-src 'self'; font-src 'self' (added the font-src)
  4. Observe things that don't load in the browser dev console
    a. Custom CSS doesn't load because it's inline
    b. Some scripts don't load because they're inline

Expected behavior

WriteFreely should be CSP-friendly and fully work with a strict CSP enabled. This would reduce attack surface for things like XSS.

Workaround

We currently have to include unsafe-inline in the styles and script sources which is considered unsafe by organizations like Mozilla.

Content-Security-Policy: default-src 'none'; img-src https:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; font-src 'self'; connect-src 'self'
  • font-src is required to load fonts
  • connect-src is required to publish drafts and posts at least

Application configuration

  • Single mode or Multi-user mode? single
  • Database? [mysql/sqlite] sqlite
  • Open registration? [yes/no] no
  • Federation enabled? [yes/no] yes

Version or last commit: v0.12.0-2-g037fc40

@Crocmagnon
Copy link
Author

@Crocmagnon Crocmagnon commented Jun 29, 2020

I suggest:

  1. Serving the custom CSS on an endpoint retrieving data from the DB instead of rendering it inline.
  2. Extract the inline Javascript to a separate file.

Note: that goes against other recommendations of reducing the number of HTTP requests for the sake of performance.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Linked pull requests

Successfully merging a pull request may close this issue.

None yet
1 participant
You can’t perform that action at this time.