Skip to content

Commit 2326a93

Browse files
labkey-adamlabkey-adam
committed
Enable a strong enforce CSP by default
1 parent a7f460f commit 2326a93

3 files changed

Lines changed: 23 additions & 77 deletions

File tree

‎server/configs/application.properties‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -122,37 +122,6 @@ management.server.port=@@shutdownPort@@
122122
#jsonaccesslog.condition-if=attributeName
123123
#jsonaccesslog.condition-unless=attributeName
124124

125-
## START OF CSP ENFORCE BLOCK (DO NOT CHANGE THIS TEXT)
126-
#useLocalBuild#csp.enforce=\
127-
#useLocalBuild# default-src 'self' ; /* Limit the default to only the current server */\
128-
#useLocalBuild# connect-src 'self' ${CONNECTION.SOURCES} ; /* Limit allowed connection sources */\
129-
#useLocalBuild# object-src 'none' ; /* These tags are not currently used by LKS */\
130-
#useLocalBuild# style-src 'self' 'unsafe-inline' ${STYLE.SOURCES} ; /* We currently have a few inline <style> tags that we are weeding out */\
131-
#useLocalBuild# img-src 'self' data: ${IMAGE.SOURCES} ; /* Limit image loading locations */\
132-
#useLocalBuild# font-src 'self' data: ${FONT.SOURCES} ; /* Limit font source loading locations */\
133-
#useLocalBuild# script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ; /* Limit scripts to those with nonces or transitive scripts */\
134-
#useLocalBuild# base-uri 'self' ; /* Limit the base tags to only source from current server */\
135-
#useLocalBuild# ${UPGRADE.INSECURE.REQUESTS} /* Conditionally add upgrade-secure-requests directive if HTTPS is required */\
136-
#useLocalBuild# frame-ancestors 'self' ; /* Limit iframe content destinations (who can load this server's content into an iframe) */\
137-
#useLocalBuild# frame-src 'self' ${FRAME.SOURCES} ; /* Limit iframe content sources (from what servers can this server's iframe content be loaded) */\
138-
#useLocalBuild# report-uri /admin-contentSecurityPolicyReport.api?cspVersion=e12&${CSP.REPORT.PARAMS} ; /* Report any encountered CSP violations to the local server */
139-
## END OF CSP ENFORCE BLOCK (DO NOT CHANGE THIS TEXT)
140-
141-
## START OF CSP REPORT BLOCK (DO NOT CHANGE THIS TEXT)
142-
csp.report=\
143-
default-src 'self' ; /* Limit the default to only the current server */\
144-
connect-src 'self' ${CONNECTION.SOURCES} ; /* Limit allowed connection sources */\
145-
object-src 'none' ; /* These tags are not currently used by LKS */\
146-
style-src 'self' 'unsafe-inline' ${STYLE.SOURCES} ; /* We currently have a few inline <style> tags that we are weeding out */\
147-
img-src 'self' data: ${IMAGE.SOURCES} ; /* Limit image loading locations */\
148-
font-src 'self' data: ${FONT.SOURCES} ; /* Limit font source loading locations */\
149-
script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ; /* Limit scripts to those with nonces or transitive scripts */\
150-
base-uri 'self' ; /* Limit the base tags to only source from current server */\
151-
frame-ancestors 'self' ; /* Limit iframe content destinations (who can load this server's content into an iframe) */\
152-
frame-src 'self' ${FRAME.SOURCES} ; /* Limit iframe content sources (from what servers can this server's iframe content be loaded) */\
153-
report-uri /admin-contentSecurityPolicyReport.api?cspVersion=r12&${CSP.REPORT.PARAMS} ; /* Report any encountered CSP violations to the local server */
154-
## END OF CSP REPORT BLOCK (DO NOT CHANGE THIS TEXT)
155-
156125
## Use a custom logging configuration
157126
#logging.config=path/to/alternative/log4j2.xml
158127

‎server/configs/webapps/embedded/config/application.properties‎

Lines changed: 0 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -107,34 +107,3 @@ mail.smtpUser=Anonymous
107107
## property name after the "context.additionalWebapps." prefix, and the value is the location of the webapp on disk
108108
#context.additionalWebapps.firstContextPath=@@/my/webapp/path@@
109109
#context.additionalWebapps.secondContextPath=@@/my/other/webapp/path@@
110-
111-
## Strong enforce content security policy. Uncomment this when you've tested the strong report-only policy (configured
112-
## by default via server code and shown below).
113-
#csp.enforce=\
114-
# default-src 'self' ; /* Limit the default to only the current server */\
115-
# connect-src 'self' ${CONNECTION.SOURCES} ; /* Limit allowed connection sources */\
116-
# object-src 'none' ; /* These tags are not currently used by LKS */\
117-
# style-src 'self' 'unsafe-inline' ${STYLE.SOURCES} ; /* We currently have a few inline <style> tags that we are weeding out */\
118-
# img-src 'self' data: ${IMAGE.SOURCES} ; /* Limit image loading locations */\
119-
# font-src 'self' data: ${FONT.SOURCES} ; /* Limit font source loading locations */\
120-
# script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ; /* Limit scripts to those with nonces or transitive scripts */\
121-
# base-uri 'self' ; /* Limit the base tags to only source from current server */\
122-
# frame-ancestors 'self' ; /* Limit iframe content destinations (who can load this server's content into an iframe) */\
123-
# frame-src 'self' ${FRAME.SOURCES} ; /* Limit iframe content sources (from what servers can this server's iframe content be loaded) */\
124-
# report-uri /admin-contentSecurityPolicyReport.api?cspVersion=e11&${CSP.REPORT.PARAMS} ; /* Report any encountered CSP violations to the supplied URL */
125-
126-
## Strict report-only content security policy that reports violations to this server. This matches the default report
127-
## policy that's configured via server code; provided here to document the details and provide a starting point if
128-
## overriding the default CSP is needed. This CSP will become the default *enforce* policy for 25.4 and beyond.
129-
csp.report=\
130-
default-src 'self' ; /* Limit the default to only the current server */\
131-
connect-src 'self' ${CONNECTION.SOURCES} ; /* Limit allowed connection sources */\
132-
object-src 'none' ; /* These tags are not currently used by LKS */\
133-
style-src 'self' 'unsafe-inline' ${STYLE.SOURCES} ; /* We currently have a few inline <style> tags that we are weeding out */\
134-
img-src 'self' data: ${IMAGE.SOURCES} ; /* Limit image loading locations */\
135-
font-src 'self' data: ${FONT.SOURCES} ; /* Limit font source loading locations */\
136-
script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ; /* Limit scripts to those with nonces or transitive scripts */\
137-
base-uri 'self' ; /* Limit the base tags to only source from current server */\
138-
frame-ancestors 'self' ; /* Limit iframe content destinations (who can load this server's content into an iframe) */\
139-
frame-src 'self' ${FRAME.SOURCES} ; /* Limit iframe content sources (from what servers can this server's iframe content be loaded) */\
140-
report-uri /admin-contentSecurityPolicyReport.api?cspVersion=r11&${CSP.REPORT.PARAMS} ; /* Report any encountered CSP violations to the supplied URL */

‎server/embedded/src/org/labkey/embedded/LabKeyServer.java‎

Lines changed: 23 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -66,8 +66,8 @@ public static void main(String[] args)
6666

6767
SpringApplication application = new SpringApplication(LabKeyServer.class);
6868
application.addListeners(new ApplicationPidFileWriter("./labkey.pid"));
69-
// A strong Content Security Policy that reports violations to this server
70-
String strongCsp = """
69+
// A strong Content Security Policy
70+
String baseCsp = """
7171
default-src 'self' ;
7272
connect-src 'self' ${CONNECTION.SOURCES} ;
7373
object-src 'none' ;
@@ -76,27 +76,35 @@ public static void main(String[] args)
7676
font-src 'self' data: ${FONT.SOURCES} ;
7777
script-src 'unsafe-eval' 'strict-dynamic' 'nonce-${REQUEST.SCRIPT.NONCE}' ;
7878
base-uri 'self' ;
79+
frame-src 'self' ${FRAME.SOURCES} ;
80+
""";
81+
// Add upgrade_insecure_requests substitution, frame-ancestors, and e12 version for enforce CSP
82+
String enforceCsp = baseCsp + """
7983
${UPGRADE.INSECURE.REQUESTS}
8084
frame-ancestors 'self' ;
81-
frame-src 'self' ${FRAME.SOURCES} ;
82-
report-uri /admin-contentSecurityPolicyReport.api?cspVersion=r12&${CSP.REPORT.PARAMS}
85+
report-uri /admin-contentSecurityPolicyReport.api?cspVersion=e12&${CSP.REPORT.PARAMS} ;
86+
""";
87+
// Leave out upgrade_insecure_requests and frame-ancestors directives, since they produce warnings on some browsers
88+
String reportCsp = baseCsp + """
89+
report-uri /admin-contentSecurityPolicyReport.api?cspVersion=r12&${CSP.REPORT.PARAMS} ;
8390
""";
8491
application.setDefaultProperties(Map.of(
85-
"server.tomcat.basedir", ".",
86-
"server.tomcat.accesslog.directory", logHome,
92+
"server.tomcat.basedir", ".",
93+
"server.tomcat.accesslog.directory", logHome,
8794

88-
// Enable HTTP compression for response content
89-
"server.compression.enabled", "true",
95+
// Enable HTTP compression for response content
96+
"server.compression.enabled", "true",
9097

91-
"server.tomcat.accesslog.enabled", "true",
92-
"server.tomcat.accesslog.pattern", "%h %l %u %t \"%r\" %s %b %D %S %I \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i",
93-
"jsonaccesslog.pattern", "%h %t %m %U %s %b %D %S \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i",
98+
"server.tomcat.accesslog.enabled", "true",
99+
"server.tomcat.accesslog.pattern", "%h %l %u %t \"%r\" %s %b %D %S %I \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i",
100+
"jsonaccesslog.pattern", "%h %t %m %U %s %b %D %S \"%{Referer}i\" \"%{User-Agent}i\" %{LABKEY.username}s %{X-Forwarded-For}i",
94101

95-
// Issue 52415: Omit stack traces from Tomcat error pages by default, but propagate error messages
96-
"server.error.include-stacktrace", "never",
97-
"server.error.include-message", "always",
102+
// Issue 52415: Omit stack traces from Tomcat error pages by default, but propagate error messages
103+
"server.error.include-stacktrace", "never",
104+
"server.error.include-message", "always",
98105

99-
"csp.report", strongCsp
106+
"csp.enforce", enforceCsp,
107+
"csp.report", reportCsp
100108
));
101109
application.setBannerMode(Banner.Mode.OFF);
102110
application.run(args);

0 commit comments

Comments
 (0)