Inline scripts CSP for login (#1871)

Martii · web-flow · commit 0ad21d8de42c · 2021-12-07T16:26:27.000-07:00
* Protect the login page a little bit more Post #944 #1867 Auto-merge
diff --git a/controllers/index.js b/controllers/index.js
@@ -11,6 +11,7 @@ var isDbg = require('../libs/debug').isDbg;
 var async = require('async');
 var _ = require('underscore');
 var url = require('url');
+var crypto = require('crypto');
 
 //--- Model inclusions
 var Discussion = require('../models/discussion').Discussion;
@@ -261,6 +262,11 @@ exports.register = function (aReq, aRes) {
   //
 
   Strategy.find({}, function (aErr, aAvailableStrategies) {
+    var SECRET = process.env.HCAPTCHA_SECRET_KEY;
+    var SITEKEY = process.env.HCAPTCHA_SITE_KEY;
+    var defaultCSP = ' \'self\'';
+    var captchaCSP = (SECRET ? ' hcaptcha.com *.hcaptcha.com' : '');
+
     if (aErr || !aAvailableStrategies) {
       statusCodePage(aReq, aRes, aNext, {
         statusCode: 503,
@@ -277,6 +283,11 @@ exports.register = function (aReq, aRes) {
         });
       });
 
+      options.hasCaptcha = (SECRET ? true : false);
+
+      options.nonce = crypto.randomBytes(512).toString('hex');
+      defaultCSP += ' \'nonce-' + options.nonce + '\'';
+
       // Insert an empty default strategy at the beginning
       // NOTE: Safari always autoselects an option when disabled
       options.strategies.unshift({'strat': '', 'display': '(default preferred authentication)'});
@@ -286,10 +297,21 @@ exports.register = function (aReq, aRes) {
         return aStrategy.display;
       });
 
+
       aRes.header('Cache-Control', 'no-cache, no-store, must-revalidate');
       aRes.header('Pragma', 'no-cache');
       aRes.header('Expires', '0');
 
+      //
+      aRes.header('Content-Security-Policy',
+        'default-src' + defaultCSP +
+        '; connect-src' + defaultCSP + captchaCSP +
+        '; frame-src'   + defaultCSP + captchaCSP +
+        '; style-src'   + defaultCSP + captchaCSP +
+        '; script-src'  + defaultCSP + captchaCSP +
+        ''
+      );
+
       aRes.render('pages/loginPage', options);
     }
   });
diff --git a/views/includes/scripts/formControlClear.html b/views/includes/scripts/formControlClear.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript"{{#nonce}} nonce="{{nonce}}"{{/nonce}}>
   (function () {
     'use strict';
 
diff --git a/views/includes/scripts/googleAnalytics.html b/views/includes/scripts/googleAnalytics.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript"{{#nonce}} nonce="{{nonce}}"{{/nonce}}>>
   (function () {
 
     if (!{{DNT}}) {
diff --git a/views/includes/scripts/hideReminders.html b/views/includes/scripts/hideReminders.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript"{{#nonce}} nonce="{{nonce}}"{{/nonce}}>>
   (function () {
 
     var events = 'focus resize scroll';
diff --git a/views/includes/scripts/loginEcho.html b/views/includes/scripts/loginEcho.html
@@ -1,4 +1,4 @@
-<script type="text/javascript">
+<script type="text/javascript"{{#nonce}} nonce="{{nonce}}"{{/nonce}}>
   (function () {
 
     // NOTE: Keep in sync with helper
diff --git a/views/pages/loginPage.html b/views/pages/loginPage.html
@@ -4,7 +4,7 @@
   <title>{{title}}</title>
   {{> includes/head.html }}
   {{#hasCaptcha}}
-  <script src="https://js.hcaptcha.com/1/api.js" async defer></script>
+  <script src="https://js.hcaptcha.com/1/api.js" async="async" defer="defer"></script>
   {{/hasCaptcha}}
 </head>
 <body>

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-<script type="text/javascript">`
	`1`	`+<script type="text/javascript"{{#nonce}} nonce="{{nonce}}"{{/nonce}}>`
`2`	`2`	`(function () {`
`3`	`3`	`'use strict';`
`4`	`4`