From b42cdf97cdc2ac04e4d1985aee780700762a31d4 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Th=C3=A9ophile=20Diot?= Date: Tue, 21 May 2024 10:58:20 +0100 Subject: [PATCH] [#1187] Update error page rendering to include Content-Security-Policy headers and nonces for a better security --- .gitleaksignore | 1 + src/common/core/errors/errors.lua | 18 ++++++++++++++++++ src/common/core/errors/files/error.html | 15 ++++++++------- 3 files changed, 27 insertions(+), 7 deletions(-) diff --git a/.gitleaksignore b/.gitleaksignore index 99ebe060b..03e06d422 100644 --- a/.gitleaksignore +++ b/.gitleaksignore @@ -10,3 +10,4 @@ src/ui/templates/settings_plugins.html:hashicorp-tf-password:297 src/ui/templates/settings_plugins.html:hashicorp-tf-password:106 src/ui/templates/account.html:hashicorp-tf-password:154 src/ui/templates/account.html:hashicorp-tf-password:162 +src/common/core/errors/files/error.html:aws-access-token:20 diff --git a/src/common/core/errors/errors.lua b/src/common/core/errors/errors.lua index fed5a2a45..2cca3ee32 100644 --- a/src/common/core/errors/errors.lua +++ b/src/common/core/errors/errors.lua @@ -1,7 +1,9 @@ local class = require "middleclass" local plugin = require "bunkerweb.plugin" +local utils = require "bunkerweb.utils" local ngx = ngx +local rand = utils.rand local subsystem = ngx.config.subsystem local tostring = tostring @@ -84,12 +86,28 @@ function errors:log() end function errors:render_template(code) + local nonce_script = rand(16) + local nonce_style = rand(16) + + -- Override headers + local header = "Content-Security-Policy" + if self.variables["CONTENT_SECURITY_POLICY_REPORT_ONLY"] == "yes" then + header = header .. "-Report-Only" + end + ngx.header[header] = "default-src 'none'; form-action 'self'; script-src 'strict-dynamic' 'nonce-" + .. nonce_script + .. "' 'unsafe-inline' http: https:; img-src 'self' data:; style-src 'self' 'nonce-" + .. nonce_style + .. "'; font-src 'self' data:; base-uri 'self'; require-trusted-types-for 'script';" + -- Render template render("error.html", { title = code .. " - " .. self.default_errors[code].title, error_title = self.default_errors[code].title, error_code = code, error_text = self.default_errors[code].text, + nonce_script = nonce_script, + nonce_style = nonce_style, }) end diff --git a/src/common/core/errors/files/error.html b/src/common/core/errors/files/error.html index 9195a7b74..24fc03977 100644 --- a/src/common/core/errors/files/error.html +++ b/src/common/core/errors/files/error.html @@ -12,17 +12,16 @@ type="image/svg+xml" /> + {-raw-} - - + - - + - - + + {-raw-} -