Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

WebProfiler CSP handler breaks on 'none' #36645

Closed
cs278 opened this issue Apr 30, 2020 · 3 comments
Closed

WebProfiler CSP handler breaks on 'none' #36645

cs278 opened this issue Apr 30, 2020 · 3 comments
Labels
Bug Status: Needs Review WebProfilerBundle

Comments

@cs278
Copy link
Contributor

cs278 commented Apr 30, 2020

Symfony version(s) affected: 3.4.40

Description
The use of the 'none' token in a CSP policy causes ContentSecurityPolicyHandler to generate invalid CSP headers.

How to reproduce

Set a CSP policy of default-src 'none'; and ensure the web profiler is enabled.

$response->headers->set('Content-Security-Policy', "default-src 'none'")

The following header will be sent to the client:

default-src 'none'; script-src 'none' 'unsafe-inline' 'nonce-123'; script-src-elem 'none' 'unsafe-inline' 'nonce-123'; style-src 'none' 'unsafe-inline' 'nonce-456'; style-src-elem 'none' 'unsafe-inline' 'nonce-456'

Chrome reports the following problems:

The source list for Content Security Policy directive 'script-src' contains an invalid source: ''none''. It will be ignored. Note that 'none' has no effect unless it is the only expression in the source list.
The source list for Content Security Policy directive 'script-src-elem' contains an invalid source: ''none''. It will be ignored. Note that 'none' has no effect unless it is the only expression in the source list.
The source list for Content Security Policy directive 'style-src' contains an invalid source: ''none''. It will be ignored. Note that 'none' has no effect unless it is the only expression in the source list.
The source list for Content Security Policy directive 'style-src-elem' contains an invalid source: ''none''. It will be ignored. Note that 'none' has no effect unless it is the only expression in the source list.

This problem also exists if you have a policy of style-src 'none' you end up with a policy like style-src 'none' 'unsafe-inline' 'nonce-789'.

Possible Solution
Remove the 'none' token when appending additional tokens.

Additional context

Found this while investigating a regression #36643
@cs278 cs278 added the Bug label Apr 30, 2020
@cs278 cs278 mentioned this issue Apr 30, 2020
Closed
@nicolas-grekas nicolas-grekas mentioned this issue May 1, 2020
Closed
@nicolas-grekas nicolas-grekas mentioned this issue May 4, 2020
Merged
@nicolas-grekas
Copy link
Member

Is this fixed by #36678? If not, can anyone investigate and send a PR?

@ndench
Copy link
Contributor

ndench commented May 5, 2020 •
edited

I'll have a shot at it sometime over the next few days, should be a quick fix I think.

@ndench ndench mentioned this issue May 12, 2020
Merged
@ndench
Copy link
Contributor

ndench commented May 12, 2020

I've got a PR up at #36786, @cs278 can you check if it fixes the issue for you?

@fabpot fabpot closed this as completed May 13, 2020
fabpot added a commit that referenced this issue May 13, 2020
@fabpot
bug #36786 [WebProfiler] Remove 'none' when appending CSP tokens (nde…
3150104 
…nch)

This PR was merged into the 4.4 branch.

Discussion
----------

[WebProfiler] Remove 'none' when appending CSP tokens

| Q             | A
| ------------- | ---
| Branch?       | 3.4, 4.4, 5.0
| Bug fix?      | yes
| New feature?  | no
| Deprecations? | no
| Tickets       | Fix #36645
| License       | MIT
| Doc PR        | n/a

@nicolas-grekas  asked me to to have a look at this after #36678.

If a user has a CSP policy of `default-src 'none'`, then the WebProfiler copies `'none'` to `script-src` and `style-src` then adds other sources. This creates an invalid policy since `'none'` is only allowed when it's the only item in the source list.

This will probably need to be merged into 3.4 first, I started on 4.4 so I can test in my current symfony project which requires 4.4.

Commits
-------

967bc4a [WebProfiler] Remove 'none' when appending CSP tokens
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
Bug Status: Needs Review WebProfilerBundle
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@cs278 @fabpot @nicolas-grekas @xabbuh @ndench @carsonbot