[#1187] Update default server page and loading page to add the CSP header for an hardened security

src/common/confs/default-server-http.conf

@@ -36,11 +36,40 @@ server {
 {% endif %}
 
 {% if IS_LOADING == "yes" +%}
-	root /usr/share/bunkerweb/loading;
-	try_files /index.html =404;
-	etag off;
-	add_header Last-Modified "";
-	server_tokens off;
+	location / {
+		etag off;
+		add_header Last-Modified "";
+		server_tokens off;
+		default_type 'text/html';
+		root /usr/share/bunkerweb/loading;
+		content_by_lua_block {
+				local utils = require "bunkerweb.utils"
+				local rand = utils.rand
+				local subsystem = ngx.config.subsystem
+
+				local template
+				local render = nil
+				if subsystem == "http" then
+					template = require "resty.template"
+					render = template.render
+				end
+
+				local nonce_style = rand(16)
+
+				-- Override CSP header
+				ngx.header["Content-Security-Policy"] = "default-src 'none'; form-action 'self'; img-src 'self' data:; style-src 'self' 'nonce-"
+						.. nonce_style
+						.. "'; font-src 'self' data:; base-uri 'self'; require-trusted-types-for 'script';"
+
+				-- Remove server header
+				ngx.header["Server"] = nil
+
+				-- Render template
+				render("index.html", {
+					nonce_style = nonce_style
+				})
+		}
+	}
 {% endif %}
 
 	# include core and plugins default-server configurations

src/common/core/misc/confs/default-server-http/page.conf

@@ -1,9 +1,36 @@
 {% if IS_LOADING != "yes" and DISABLE_DEFAULT_SERVER == "no" +%}
-root /usr/share/bunkerweb/core/misc/files;
 location / {
-	try_files /default.html =404;
 	etag off;
 	add_header Last-Modified "";
 	server_tokens off;
+	default_type 'text/html';
+	root /usr/share/bunkerweb/core/misc/files;
+	content_by_lua_block {
+			local utils = require "bunkerweb.utils"
+			local rand = utils.rand
+			local subsystem = ngx.config.subsystem
+
+			local template
+			local render = nil
+			if subsystem == "http" then
+				template = require "resty.template"
+				render = template.render
+			end
+
+			local nonce_style = rand(16)
+
+			-- Override CSP header
+			ngx.header["Content-Security-Policy"] = "default-src 'none'; form-action 'self'; img-src 'self' data:; style-src 'self' 'nonce-"
+				.. nonce_style
+				.. "'; font-src 'self' data:; base-uri 'self'; require-trusted-types-for 'script';"
+
+			-- Remove server header
+			ngx.header["Server"] = nil
+
+			-- Render template
+			render("default.html", {
+				nonce_style = nonce_style,
+			})
+	}
 }
 {% endif %}