headers.rs 94.3%

116 of 123 lines run, 29 of 49 functions · run #480 on api-unknown-fields · run missed

//! Security headers on every response (oxygenhub#222), and the endpoint
//! the browser reports Content-Security-Policy violations to.
//!
//! The policy is sent as `Content-Security-Policy-Report-Only` while the
//! pages still carry inline scripts and handlers: browsers report what the
//! policy would block, the hub logs it, and nothing breaks. Switching to
//! enforcing is one constant ([`ENFORCE`]) once the reports are quiet.
//! Responses that set their own policy (report frames, #127; a job's
//! HTML artifact) keep theirs, and may be framed as they say.
//! Strict-Transport-Security is sent only when `[server] hsts_max_age` is
//! set (oxygenhub#231), raised in stages: browsers keep it.

use axum::http::{header, HeaderName, HeaderValue};
use axum::response::Response;
use std::collections::HashMap;
use std::sync::Mutex;

/// Where violation reports go.
pub const REPORT_PATH: &str = "/csp-report";

/// Enforce the policy rather than only report it.
const ENFORCE: bool = false;

/// What the pages may load: their own scripts (and WebAssembly, for the
/// backdrop), styles (inline too: style attributes are everywhere), images
/// from anywhere over https (READMEs show badges), and forms posted only to
/// the hub (sign-in providers are reached by links, not forms).
const POLICY: &str = "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; \
img-src 'self' data: https:; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'none'; \
base-uri 'self'; form-action 'self'; frame-ancestors 'none'; report-uri /csp-report; report-to csp";

const PERMISSIONS: &str = "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), \
midi=(), magnetometer=(), gyroscope=(), accelerometer=(), display-capture=(), browsing-topics=(), interest-cohort=()";

/// The Strict-Transport-Security value for a site, if it sends one
/// (oxygenhub#231): only for an https address and a max-age above 0.
pub fn hsts(base_url: &str, max_age: u64) -> Option<HeaderValue> {
    (base_url.starts_with("https://") && max_age > 0).then(|| HeaderValue::from_str(&format!("max-age={max_age}")).ok()).flatten()
}

/// Adds the headers a response does not already carry.
pub async fn security_headers(
    axum::extract::State(hsts): axum::extract::State<Option<HeaderValue>>,
    req: axum::extract::Request,
    next: axum::middleware::Next,
) -> Response {
    let mut res = next.run(req).await;
    let h = res.headers_mut();
    if let Some(v) = hsts {
        h.entry(header::STRICT_TRANSPORT_SECURITY).or_insert(v);
    }
    let own_policy = h.contains_key(header::CONTENT_SECURITY_POLICY);
    let mut set = |name: HeaderName, value: &'static str| {
        h.entry(name).or_insert(HeaderValue::from_static(value));
    };
    set(header::X_CONTENT_TYPE_OPTIONS, "nosniff");
    set(header::REFERRER_POLICY, "strict-origin-when-cross-origin");
    set(HeaderName::from_static("permissions-policy"), PERMISSIONS);
    if !own_policy {
        set(header::X_FRAME_OPTIONS, "DENY");
        set(HeaderName::from_static("reporting-endpoints"), "csp=\"/csp-report\"");
        let name = if ENFORCE { header::CONTENT_SECURITY_POLICY } else { header::CONTENT_SECURITY_POLICY_REPORT_ONLY };
        set(name, POLICY);
    }
    res
}

/// One violation, as either report format gives it.
#[derive(Debug, PartialEq)]
pub struct Violation {
    pub page: String,
    pub directive: String,
    pub blocked: String,
    pub source: String,
}

/// The violations in a report body: the older `application/csp-report`
/// (`{"csp-report": {...}}`) or the Reporting API's list.
pub fn violations(body: &[u8]) -> Vec<Violation> {
    let Ok(v) = serde_json::from_slice::<serde_json::Value>(body) else { return vec![] };
    let s = |v: &serde_json::Value, keys: &[&str]| {
        keys.iter().find_map(|k| v.get(*k).and_then(|x| x.as_str().map(String::from).or_else(|| x.as_u64().map(|n| n.to_string()))))
    };
    let one = |r: &serde_json::Value, page: &[&str], dir: &[&str], blocked: &[&str], file: &[&str], line: &[&str]| Violation {
        page: s(r, page).unwrap_or_default(),
        directive: s(r, dir).unwrap_or_default(),
        blocked: s(r, blocked).unwrap_or_default(),
        source: match (s(r, file), s(r, line)) {
            (Some(f), Some(l)) => format!("{f}:{l}"),
            (Some(f), None) => f,
            _ => String::new(),
        },
    };
    if let Some(r) = v.get("csp-report") {
        return vec![one(
            r,
            &["document-uri"],
            &["effective-directive", "violated-directive"],
            &["blocked-uri"],
            &["source-file"],
            &["line-number"],
        )];
    }
    v.as_array()
        .map(|list| {
            list.iter()
                .filter(|r| r.get("type").and_then(|t| t.as_str()) == Some("csp-violation"))
                .filter_map(|r| r.get("body"))
                .map(|b| one(b, &["documentURL"], &["effectiveDirective"], &["blockedURL"], &["sourceFile"], &["lineNumber"]))
                .collect()
        })
        .unwrap_or_default()
}

/// Each distinct violation is logged once an hour, so a busy page does not
/// flood the log.
static SEEN: Mutex<Option<HashMap<String, i64>>> = Mutex::new(None);
const LOG_EVERY_MS: i64 = 60 * 60_000;

fn first_in_a_while(key: String, now_ms: i64) -> bool {
    let mut seen = SEEN.lock().unwrap();
    let seen = seen.get_or_insert_with(HashMap::new);
    if seen.len() > 1000 {
        seen.retain(|_, t| now_ms - *t < LOG_EVERY_MS);
    }
    match seen.get(&key) {
        Some(t) if now_ms - t < LOG_EVERY_MS => false,
        _ => {
            seen.insert(key, now_ms);
            true
        }
    }
}

/// `POST /csp-report`: log what the policy would block.
pub async fn csp_report(body: axum::body::Bytes) -> axum::http::StatusCode {
    let clip = |s: &str| s.chars().filter(|c| !c.is_control()).take(200).collect::<String>();
    for v in violations(&body) {
        // The page's path only: a query can hold anything.
        let page = v.page.split(['?', '#']).next().unwrap_or("").to_string();
        let key = format!("{}|{}|{}", v.directive, v.blocked, v.source);
        if first_in_a_while(key, crate::db::now_ms()) {
            tracing::warn!("csp would block: {} {} on {} ({})", clip(&v.directive), clip(&v.blocked), clip(&page), clip(&v.source));
        }
    }
    axum::http::StatusCode::NO_CONTENT
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn both_report_formats_are_read() {
        let old = br#"{"csp-report":{"document-uri":"https://hub.example/a?b","violated-directive":"script-src-elem","blocked-uri":"inline","source-file":"https://hub.example/a","line-number":12}}"#;
        assert_eq!(
            violations(old),
            vec![Violation {
                page: "https://hub.example/a?b".into(),
                directive: "script-src-elem".into(),
                blocked: "inline".into(),
                source: "https://hub.example/a:12".into()
            }]
        );
        let new = br#"[{"type":"csp-violation","url":"https://hub.example/x","body":{"documentURL":"https://hub.example/x","effectiveDirective":"img-src","blockedURL":"http://cdn.example/i.png"}},{"type":"deprecation","body":{}}]"#;
        let v = violations(new);
        assert_eq!(v.len(), 1);
        assert_eq!((v[0].directive.as_str(), v[0].blocked.as_str(), v[0].source.as_str()), ("img-src", "http://cdn.example/i.png", ""));
        assert!(violations(b"not json").is_empty());
    }

    #[test]
    fn a_violation_is_logged_once_an_hour() {
        let k = || "script-src|inline|test-only".to_string();
        assert!(first_in_a_while(k(), 1_000));
        assert!(!first_in_a_while(k(), 2_000));
        assert!(first_in_a_while(k(), 1_000 + LOG_EVERY_MS));
    }
}

1		//! Security headers on every response (oxygenhub#222), and the endpoint
2		//! the browser reports Content-Security-Policy violations to.
3		//!
4		//! The policy is sent as `Content-Security-Policy-Report-Only` while the
5		//! pages still carry inline scripts and handlers: browsers report what the
6		//! policy would block, the hub logs it, and nothing breaks. Switching to
7		//! enforcing is one constant ([`ENFORCE`]) once the reports are quiet.
8		//! Responses that set their own policy (report frames, #127; a job's
9		//! HTML artifact) keep theirs, and may be framed as they say.
10		//! Strict-Transport-Security is sent only when `[server] hsts_max_age` is
11		//! set (oxygenhub#231), raised in stages: browsers keep it.
12
13		use axum::http::{header, HeaderName, HeaderValue};
14		use axum::response::Response;
15		use std::collections::HashMap;
16		use std::sync::Mutex;
17
18		/// Where violation reports go.
19		pub const REPORT_PATH: &str = "/csp-report";
20
21		/// Enforce the policy rather than only report it.
22		const ENFORCE: bool = false;
23
24		/// What the pages may load: their own scripts (and WebAssembly, for the
25		/// backdrop), styles (inline too: style attributes are everywhere), images
26		/// from anywhere over https (READMEs show badges), and forms posted only to
27		/// the hub (sign-in providers are reached by links, not forms).
28		const POLICY: &str = "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; \
29		img-src 'self' data: https:; font-src 'self'; connect-src 'self'; media-src 'self'; object-src 'none'; \
30		base-uri 'self'; form-action 'self'; frame-ancestors 'none'; report-uri /csp-report; report-to csp";
31
32		const PERMISSIONS: &str = "camera=(), microphone=(), geolocation=(), payment=(), usb=(), serial=(), bluetooth=(), \
33		midi=(), magnetometer=(), gyroscope=(), accelerometer=(), display-capture=(), browsing-topics=(), interest-cohort=()";
34
35		/// The Strict-Transport-Security value for a site, if it sends one
36		/// (oxygenhub#231): only for an https address and a max-age above 0.
37	2671×	pub fn hsts(base_url: &str, max_age: u64) -> Option<HeaderValue> {
38	2671×	(base_url.starts_with("https://") && max_age > 0).then(\|\| HeaderValue::from_str(&format!("max-age={max_age}")).ok()).flatten()
39	2671×	}
40
41		/// Adds the headers a response does not already carry.
42	3659×	pub async fn security_headers(
43	3659×	axum::extract::State(hsts): axum::extract::State<Option<HeaderValue>>,
44	3659×	req: axum::extract::Request,
45	3659×	next: axum::middleware::Next,
46	3659×	) -> Response {
47	3659×	let mut res = next.run(req).await;
48	3659×	let h = res.headers_mut();
49	3659×	if let Some(v) = hsts {
50	0×	h.entry(header::STRICT_TRANSPORT_SECURITY).or_insert(v);
51	3659×	}
52	3659×	let own_policy = h.contains_key(header::CONTENT_SECURITY_POLICY);
53	21933×	let mut set = \|name: HeaderName, value: &'static str\| {
54	21933×	h.entry(name).or_insert(HeaderValue::from_static(value));
55	21933×	};
56	3659×	set(header::X_CONTENT_TYPE_OPTIONS, "nosniff");
57	3659×	set(header::REFERRER_POLICY, "strict-origin-when-cross-origin");
58	3659×	set(HeaderName::from_static("permissions-policy"), PERMISSIONS);
59	3659×	if !own_policy {
60	3652×	set(header::X_FRAME_OPTIONS, "DENY");
61	3652×	set(HeaderName::from_static("reporting-endpoints"), "csp=\"/csp-report\"");
62	3652×	let name = if ENFORCE { header::CONTENT_SECURITY_POLICY } else { header::CONTENT_SECURITY_POLICY_REPORT_ONLY };
63	3652×	set(name, POLICY);
64	7×	}
65	3659×	res
66	3659×	}
67
68		/// One violation, as either report format gives it.
69		#[derive(Debug, PartialEq)]
70		pub struct Violation {
71		pub page: String,
72		pub directive: String,
73		pub blocked: String,
74		pub source: String,
75		}
76
77		/// The violations in a report body: the older `application/csp-report`
78		/// (`{"csp-report": {...}}`) or the Reporting API's list.
79	4×	pub fn violations(body: &[u8]) -> Vec<Violation> {
80	4×	let Ok(v) = serde_json::from_slice::<serde_json::Value>(body) else { return vec![] };
81	15×	let s = \|v: &serde_json::Value, keys: &[&str]\| {
82	17×	keys.iter().find_map(\|k\| v.get(*k).and_then(\|x\| x.as_str().map(String::from).or_else(\|\| x.as_u64().map(\|n\| n.to_string()))))
83	15×	};
84	3×	let one = \|r: &serde_json::Value, page: &[&str], dir: &[&str], blocked: &[&str], file: &[&str], line: &[&str]\| Violation {
85	3×	page: s(r, page).unwrap_or_default(),
86	3×	directive: s(r, dir).unwrap_or_default(),
87	3×	blocked: s(r, blocked).unwrap_or_default(),
88	3×	source: match (s(r, file), s(r, line)) {
89	1×	(Some(f), Some(l)) => format!("{f}:{l}"),
90	0×	(Some(f), None) => f,
91	2×	_ => String::new(),
92		},
93	3×	};
94	3×	if let Some(r) = v.get("csp-report") {
95	2×	return vec![one(
96	2×	r,
97	2×	&["document-uri"],
98	2×	&["effective-directive", "violated-directive"],
99	2×	&["blocked-uri"],
100	2×	&["source-file"],
101	2×	&["line-number"],
102	2×	)];
103	1×	}
104	1×	v.as_array()
105	1×	.map(\|list\| {
106	1×	list.iter()
107	2×	.filter(\|r\| r.get("type").and_then(\|t\| t.as_str()) == Some("csp-violation"))
108	1×	.filter_map(\|r\| r.get("body"))
109	1×	.map(\|b\| one(b, &["documentURL"], &["effectiveDirective"], &["blockedURL"], &["sourceFile"], &["lineNumber"]))
110	1×	.collect()
111	1×	})
112	1×	.unwrap_or_default()
113	4×	}
114
115		/// Each distinct violation is logged once an hour, so a busy page does not
116		/// flood the log.
117		static SEEN: Mutex<Option<HashMap<String, i64>>> = Mutex::new(None);
118		const LOG_EVERY_MS: i64 = 60 * 60_000;
119
120	4×	fn first_in_a_while(key: String, now_ms: i64) -> bool {
121	4×	let mut seen = SEEN.lock().unwrap();
122	4×	let seen = seen.get_or_insert_with(HashMap::new);
123	4×	if seen.len() > 1000 {
124	0×	seen.retain(\|_, t\| now_ms - *t < LOG_EVERY_MS);
125	4×	}
126	4×	match seen.get(&key) {
127	2×	Some(t) if now_ms - t < LOG_EVERY_MS => false,
128		_ => {
129	3×	seen.insert(key, now_ms);
130	3×	true
131		}
132		}
133	4×	}
134
135		/// `POST /csp-report`: log what the policy would block.
136	1×	pub async fn csp_report(body: axum::body::Bytes) -> axum::http::StatusCode {
137	1×	let clip = \|s: &str\| s.chars().filter(\|c\| !c.is_control()).take(200).collect::<String>();
138	1×	for v in violations(&body) {
139		// The page's path only: a query can hold anything.
140	1×	let page = v.page.split(['?', '#']).next().unwrap_or("").to_string();
141	1×	let key = format!("{}\|{}\|{}", v.directive, v.blocked, v.source);
142	1×	if first_in_a_while(key, crate::db::now_ms()) {
143	1×	tracing::warn!("csp would block: {} {} on {} ({})", clip(&v.directive), clip(&v.blocked), clip(&page), clip(&v.source));
144	0×	}
145		}
146	1×	axum::http::StatusCode::NO_CONTENT
147	1×	}
148
149		#[cfg(test)]
150		mod tests {
151		use super::*;
152
153		#[test]
154	1×	fn both_report_formats_are_read() {
155	1×	let old = br#"{"csp-report":{"document-uri":"https://hub.example/a?b","violated-directive":"script-src-elem","blocked-uri":"inline","source-file":"https://hub.example/a","line-number":12}}"#;
156	1×	assert_eq!(
157	1×	violations(old),
158	1×	vec![Violation {
159	1×	page: "https://hub.example/a?b".into(),
160	1×	directive: "script-src-elem".into(),
161	1×	blocked: "inline".into(),
162	1×	source: "https://hub.example/a:12".into()
163	1×	}]
164		);
165	1×	let new = br#"[{"type":"csp-violation","url":"https://hub.example/x","body":{"documentURL":"https://hub.example/x","effectiveDirective":"img-src","blockedURL":"http://cdn.example/i.png"}},{"type":"deprecation","body":{}}]"#;
166	1×	let v = violations(new);
167	1×	assert_eq!(v.len(), 1);
168	1×	assert_eq!((v[0].directive.as_str(), v[0].blocked.as_str(), v[0].source.as_str()), ("img-src", "http://cdn.example/i.png", ""));
169	1×	assert!(violations(b"not json").is_empty());
170	1×	}
171
172		#[test]
173	1×	fn a_violation_is_logged_once_an_hour() {
174	3×	let k = \|\| "script-src\|inline\|test-only".to_string();
175	1×	assert!(first_in_a_while(k(), 1_000));
176	1×	assert!(!first_in_a_while(k(), 2_000));
177	1×	assert!(first_in_a_while(k(), 1_000 + LOG_EVERY_MS));
178	1×	}
179		}

`/`	Search
`g` `c`	Code
`g` `h`	History
`g` `b`	Bookmarks
`g` `t`	Trust
`y`	Permalink to this state (files and trees)
`?`	This sheet

Coverage / crates/hub/src/headers.rs 94.3%

Keyboard