content_security_policy.rb 3.1 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384
  1. # Define an application-wide content security policy
  2. # For further information see the following documentation
  3. # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
  4. def host_to_url(str)
  5. return if str.blank?
  6. uri = Addressable::URI.parse("http#{Rails.configuration.x.use_https ? 's' : ''}://#{str}")
  7. uri.path += '/' unless uri.path.blank? || uri.path.end_with?('/')
  8. uri.to_s
  9. end
  10. base_host = Rails.configuration.x.web_domain
  11. assets_host = Rails.configuration.action_controller.asset_host
  12. assets_host ||= host_to_url(base_host)
  13. media_host = host_to_url(ENV['S3_ALIAS_HOST'])
  14. media_host ||= host_to_url(ENV['S3_CLOUDFRONT_HOST'])
  15. media_host ||= host_to_url(ENV['S3_HOSTNAME']) if ENV['S3_ENABLED'] == 'true'
  16. media_host ||= assets_host
  17. Rails.application.config.content_security_policy do |p|
  18. p.base_uri :none
  19. p.default_src :none
  20. p.frame_ancestors :none
  21. p.font_src :self, assets_host
  22. p.img_src :self, :https, :data, :blob, assets_host
  23. p.style_src :self, assets_host
  24. p.media_src :self, :https, :data, assets_host
  25. p.frame_src :self, :https
  26. p.manifest_src :self, assets_host
  27. p.form_action :self
  28. if Rails.env.development?
  29. webpacker_urls = %w(ws http).map { |protocol| "#{protocol}#{Webpacker.dev_server.https? ? 's' : ''}://#{Webpacker.dev_server.host_with_port}" }
  30. p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url, *webpacker_urls
  31. p.script_src :self, :unsafe_inline, :unsafe_eval, assets_host
  32. p.child_src :self, :blob, assets_host
  33. p.worker_src :self, :blob, assets_host
  34. else
  35. p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url
  36. p.script_src :self, assets_host, "'wasm-unsafe-eval'"
  37. p.child_src :self, :blob, assets_host
  38. p.worker_src :self, :blob, assets_host
  39. end
  40. end
  41. # Report CSP violations to a specified URI
  42. # For further information see the following documentation:
  43. # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy-Report-Only
  44. # Rails.application.config.content_security_policy_report_only = true
  45. Rails.application.config.content_security_policy_nonce_generator = -> request { SecureRandom.base64(16) }
  46. Rails.application.config.content_security_policy_nonce_directives = %w(style-src)
  47. Rails.application.reloader.to_prepare do
  48. PgHero::HomeController.content_security_policy do |p|
  49. p.script_src :self, :unsafe_inline, assets_host
  50. p.style_src :self, :unsafe_inline, assets_host
  51. end
  52. PgHero::HomeController.after_action do
  53. request.content_security_policy_nonce_generator = nil
  54. end
  55. if Rails.env.development?
  56. LetterOpenerWeb::LettersController.content_security_policy do |p|
  57. p.child_src :self
  58. p.connect_src :none
  59. p.frame_ancestors :self
  60. p.frame_src :self
  61. p.script_src :unsafe_inline
  62. p.style_src :unsafe_inline
  63. p.worker_src :none
  64. end
  65. LetterOpenerWeb::LettersController.after_action do |p|
  66. request.content_security_policy_nonce_directives = %w(script-src)
  67. end
  68. end
  69. end