WWSympa: Add CSP nonce-source to inline script (sympa-community#1122)

ikedas · Mar 8, 2023 · 8d3ef4c · 8d3ef4c
1 parent 7cd6f01
commit 8d3ef4c
Show file tree

Hide file tree

Showing 6 changed files with 20 additions and 1 deletion.
diff --git a/default/web_tt2/crash.tt2 b/default/web_tt2/crash.tt2
@@ -3,6 +3,8 @@
     <!-- crash.tt2 -->
     <head>
         <meta charset="UTF-8" />
+        <meta http-equiv="Content-Security-Policy"
+         content="script-src 'self' 'unsafe-inline' 'nonce-[% csp_nonce %]'" />
         <meta name="generator" content="Sympa [% version %]" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         <title> [% main_title %] - [% action %] </title>

diff --git a/default/web_tt2/head_javascript.tt2 b/default/web_tt2/head_javascript.tt2
@@ -6,7 +6,7 @@
 ## Use the js/sympa.js file instead of writing your scripts.
 ## This script only contains variable initializations.
 #%]
-<script>
+<script nonce="[% csp_nonce %]">
 <!--
 [%# A few configuration settings and miscellaneous vars. ~%]
 var sympa = {

diff --git a/default/web_tt2/main.tt2 b/default/web_tt2/main.tt2
@@ -3,6 +3,8 @@
     <!-- main.tt2 -->
     <head>
         <meta charset="UTF-8" />
+        <meta http-equiv="Content-Security-Policy"
+         content="script-src 'self' 'unsafe-inline' 'nonce-[% csp_nonce %]'" />
         <meta name="generator" content="Sympa [% version %]" />
         <meta name="viewport"  content="width=device-width, initial-scale=1.0">
         <title> [% main_title %] - [% action %] </title>

diff --git a/default/web_tt2/tt2_error.tt2 b/default/web_tt2/tt2_error.tt2
@@ -3,6 +3,8 @@
     <!-- tt2_error.tt2 -->
     <head>
         <meta charset="UTF-8" />
+        <meta http-equiv="Content-Security-Policy"
+         content="script-src 'self' 'unsafe-inline' 'nonce-[% csp_nonce %]'" />
         <meta name="generator" content="Sympa [% version %]" />
         <meta name="viewport" content="width=device-width, initial-scale=1.0">
         <title> [% main_title %] - [% action %] </title>

diff --git a/src/cgi/wwsympa.fcgi.in b/src/cgi/wwsympa.fcgi.in
@@ -2292,6 +2292,9 @@ sub send_html {
     ## Workaround for Internet Explorer 8 or later.
     print "X-UA-Compatible: IE=100\n";
 
+    # Calculate CSP nonce.
+    $param->{'csp_nonce'} = Sympa::Tools::Text::nonce();
+
     ## Notify crash to client.
     if ($param->{'action'} eq 'crash') {
         print "Status: 503 Service Unavailable\n";

diff --git a/src/lib/Sympa/Tools/Text.pm b/src/lib/Sympa/Tools/Text.pm
@@ -400,6 +400,16 @@ sub _url_query_string {
     }
 }
 
+#FIXME: rand() is not cryptographically secure, despite CSP requesting.
+sub nonce {
+    my $md5 = Digest::MD5->new;
+    $md5->add(time);
+    foreach (0..7) {
+        $md5->add(pack 'S', int rand(2 << 16 - 1));
+    }
+    return MIME::Base64::encode_base64url($md5->digest);
+}
+
 sub permalink_id {
     my $message_id = shift;