From 90df02bbbfa2183168c0cfdf4b91cd25b665c0ec Mon Sep 17 00:00:00 2001 From: Wyatt Pearsall Date: Thu, 19 Sep 2024 14:42:16 -0700 Subject: [PATCH 1/3] Switch to nonce-based CSP --- .../jinja2/agreements/base_agreements.html | 2 +- .../jinja2/ask-cfpb/landing-page.html | 4 +- cfgov/cfgov/settings/base.py | 109 ++---------------- cfgov/cfgov/settings/local.py | 2 - .../filing_instruction_guide/index.html | 2 +- .../jinja2/housing_counselor/index.html | 4 +- cfgov/jinja2/ccdb-complaint/ccdb-search.html | 2 +- .../owning-a-home/explore-rates/index.html | 2 +- cfgov/jinja2/rural-or-underserved/index.html | 2 +- .../paying-for-college/college-costs.html | 2 +- .../jinja2/paying-for-college/disclosure.html | 2 +- .../jinja2/prepaid_agreements/detail.html | 2 +- .../jinja2/prepaid_agreements/index.html | 2 +- .../privacy/disclosure-consent-form.html | 2 +- .../jinja2/privacy/records-access-form.html | 2 +- .../regulations3k/browse-regulation.html | 2 +- .../jinja2/regulations3k/landing-page.html | 2 +- .../regulations3k/regulations3k-side-nav.html | 2 +- .../regulations3k/search-regulations.html | 2 +- .../jinja2/retirement_api/claiming.html | 2 +- cfgov/v1/jinja2/v1/layouts/404.html | 5 - cfgov/v1/jinja2/v1/layouts/500.html | 5 - cfgov/v1/jinja2/v1/layouts/base.html | 14 +-- cfgov/v1/jinja2/v1/layouts/layout-1-3.html | 2 +- cfgov/wellbeing/jinja2/wellbeing/home.html | 2 +- cfgov/wellbeing/jinja2/wellbeing/results.html | 2 +- 26 files changed, 41 insertions(+), 140 deletions(-) diff --git a/cfgov/agreements/jinja2/agreements/base_agreements.html b/cfgov/agreements/jinja2/agreements/base_agreements.html index 60e9e553810..875817e3dff 100644 --- a/cfgov/agreements/jinja2/agreements/base_agreements.html +++ b/cfgov/agreements/jinja2/agreements/base_agreements.html @@ -9,7 +9,7 @@ {{ super() }} - + {% endblock javascript %} diff --git a/cfgov/cfgov/settings/base.py b/cfgov/cfgov/settings/base.py index d7029c71985..d65e2f3a6f4 100644 --- a/cfgov/cfgov/settings/base.py +++ b/cfgov/cfgov/settings/base.py @@ -463,117 +463,28 @@ "HOSTNAMES": environment_json("CLOUDFRONT_PURGE_HOSTNAMES") } -# CSP Allowlists +# CSP # -# Please note: Changing these lists will change the value of the -# Content-Security-Policy header Django returns. Django does NOT include -# header values when calculating the response hash returned in the ETag -# header. -# Our Akamai cache uses the ETag header to know whether a cached copy of a -# page has been updated after it expires or after an invalidation purge. -# -# Together, this means that any changes to these CSP values WILL NOT BE -# RETURNED by Akamai until a page's non-header content changes, or a -# delete-purge is performed. +# See https://web.dev/articles/strict-csp -# These specify what is allowed in {% endblock javascript %} diff --git a/cfgov/housing_counselor/jinja2/housing_counselor/index.html b/cfgov/housing_counselor/jinja2/housing_counselor/index.html index 54ff3376b6d..9e50b827320 100644 --- a/cfgov/housing_counselor/jinja2/housing_counselor/index.html +++ b/cfgov/housing_counselor/jinja2/housing_counselor/index.html @@ -315,7 +315,7 @@

{% block javascript %} {{ super() }} - - {% endblock javascript %} diff --git a/cfgov/jinja2/ccdb-complaint/ccdb-search.html b/cfgov/jinja2/ccdb-complaint/ccdb-search.html index f04c3f1f834..a256f5b0db8 100644 --- a/cfgov/jinja2/ccdb-complaint/ccdb-search.html +++ b/cfgov/jinja2/ccdb-complaint/ccdb-search.html @@ -38,7 +38,7 @@ {% block javascript scoped %} {{ super() }} - diff --git a/cfgov/paying_for_college/jinja2/paying-for-college/college-costs.html b/cfgov/paying_for_college/jinja2/paying-for-college/college-costs.html index 460c532aec0..023103a755d 100644 --- a/cfgov/paying_for_college/jinja2/paying-for-college/college-costs.html +++ b/cfgov/paying_for_college/jinja2/paying-for-college/college-costs.html @@ -77,7 +77,7 @@

Your financial path to graduation

{% block javascript scoped %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/paying_for_college/jinja2/paying-for-college/disclosure.html b/cfgov/paying_for_college/jinja2/paying-for-college/disclosure.html index 7a15cc7c2cd..e88cf48bef6 100644 --- a/cfgov/paying_for_college/jinja2/paying-for-college/disclosure.html +++ b/cfgov/paying_for_college/jinja2/paying-for-college/disclosure.html @@ -3332,7 +3332,7 @@

{% block javascript scoped %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/prepaid_agreements/jinja2/prepaid_agreements/detail.html b/cfgov/prepaid_agreements/jinja2/prepaid_agreements/detail.html index 4520af9cd3c..f730f701903 100644 --- a/cfgov/prepaid_agreements/jinja2/prepaid_agreements/detail.html +++ b/cfgov/prepaid_agreements/jinja2/prepaid_agreements/detail.html @@ -137,7 +137,7 @@

{% block javascript scoped %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/prepaid_agreements/jinja2/prepaid_agreements/index.html b/cfgov/prepaid_agreements/jinja2/prepaid_agreements/index.html index f7a48745ecf..16e7877353e 100644 --- a/cfgov/prepaid_agreements/jinja2/prepaid_agreements/index.html +++ b/cfgov/prepaid_agreements/jinja2/prepaid_agreements/index.html @@ -89,7 +89,7 @@

Search within

{% block javascript %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/privacy/jinja2/privacy/disclosure-consent-form.html b/cfgov/privacy/jinja2/privacy/disclosure-consent-form.html index 42d71fbbc39..072e04291ea 100644 --- a/cfgov/privacy/jinja2/privacy/disclosure-consent-form.html +++ b/cfgov/privacy/jinja2/privacy/disclosure-consent-form.html @@ -304,7 +304,7 @@

Consent for disclosure of records

{% block javascript %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/privacy/jinja2/privacy/records-access-form.html b/cfgov/privacy/jinja2/privacy/records-access-form.html index fbec1e23d9d..a1e3658ffeb 100644 --- a/cfgov/privacy/jinja2/privacy/records-access-form.html +++ b/cfgov/privacy/jinja2/privacy/records-access-form.html @@ -277,7 +277,7 @@

Consent for release of records

{% block javascript %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/regulations3k/jinja2/regulations3k/browse-regulation.html b/cfgov/regulations3k/jinja2/regulations3k/browse-regulation.html index 0b9a00fe5db..56695a45b83 100644 --- a/cfgov/regulations3k/jinja2/regulations3k/browse-regulation.html +++ b/cfgov/regulations3k/jinja2/regulations3k/browse-regulation.html @@ -312,7 +312,7 @@

{{ page.title }}

{% block javascript scoped %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/regulations3k/jinja2/regulations3k/search-regulations.html b/cfgov/regulations3k/jinja2/regulations3k/search-regulations.html index c337ebb00d1..7179871e063 100644 --- a/cfgov/regulations3k/jinja2/regulations3k/search-regulations.html +++ b/cfgov/regulations3k/jinja2/regulations3k/search-regulations.html @@ -194,7 +194,7 @@

Refine results

{% block javascript scoped %} {{ super() }} - {% endblock javascript %} diff --git a/cfgov/v1/jinja2/v1/layouts/404.html b/cfgov/v1/jinja2/v1/layouts/404.html index 4aac88f52be..0afa2396b50 100644 --- a/cfgov/v1/jinja2/v1/layouts/404.html +++ b/cfgov/v1/jinja2/v1/layouts/404.html @@ -53,8 +53,3 @@

404: Page not found

{% endblock %} - -{% block javascript %} -{# Include site-wide JavaScript. #} - -{% endblock javascript %} diff --git a/cfgov/v1/jinja2/v1/layouts/500.html b/cfgov/v1/jinja2/v1/layouts/500.html index f12bfd38124..69bb76e2151 100644 --- a/cfgov/v1/jinja2/v1/layouts/500.html +++ b/cfgov/v1/jinja2/v1/layouts/500.html @@ -53,8 +53,3 @@

500: Server error

{% endblock %} - -{% block javascript %} -{# Include site-wide JavaScript. #} - -{% endblock javascript %} diff --git a/cfgov/v1/jinja2/v1/layouts/base.html b/cfgov/v1/jinja2/v1/layouts/base.html index 981470ca081..09bce2b276e 100644 --- a/cfgov/v1/jinja2/v1/layouts/base.html +++ b/cfgov/v1/jinja2/v1/layouts/base.html @@ -150,7 +150,7 @@ href="{{ static('fonts/627fbb5a-3bae-4cd9-b617-2f923e29d55e.woff2') }}" as="font" type="font/woff2" crossorigin> - + {# Preconnecting comes from the 3rd best practice in https://developer.mozilla.org/en-US/docs/Web/Performance/dns-prefetch#best_practices #} @@ -184,7 +184,7 @@ {# Begin Google Optimize #} {# Optimize anti-flicker snippet. #} - {% endblock javascript_loader %} - {% if flag_enabled('PATH_MATCHES_FOR_QUALTRICS') %} - {% endblock javascript %} diff --git a/cfgov/wellbeing/jinja2/wellbeing/home.html b/cfgov/wellbeing/jinja2/wellbeing/home.html index 8b03f1c44e4..78bfd55d754 100644 --- a/cfgov/wellbeing/jinja2/wellbeing/home.html +++ b/cfgov/wellbeing/jinja2/wellbeing/home.html @@ -984,7 +984,7 @@

{{ _('About this questionnaire') }}

{% block javascript scoped %} {{ super() }} - {% endblock %} diff --git a/cfgov/wellbeing/jinja2/wellbeing/results.html b/cfgov/wellbeing/jinja2/wellbeing/results.html index fef2fbd7da4..853666777b5 100644 --- a/cfgov/wellbeing/jinja2/wellbeing/results.html +++ b/cfgov/wellbeing/jinja2/wellbeing/results.html @@ -517,7 +517,7 @@

{{ _('About this questionnaire') }}

{% block javascript scoped %} {{ super() }} - {% endblock %} From ff68db540f100fa7718cf5bd1f8f3d0a6d5f176b Mon Sep 17 00:00:00 2001 From: Wyatt Pearsall Date: Fri, 27 Sep 2024 13:30:32 -0700 Subject: [PATCH 2/3] Don't set CSP for wagtail admin pages and override userbar --- cfgov/cfgov/settings/base.py | 1 + .../templates/wagtailadmin/userbar/base.html | 41 +++++++++++++++++++ 2 files changed, 42 insertions(+) create mode 100644 cfgov/wagtailadmin_overrides/templates/wagtailadmin/userbar/base.html diff --git a/cfgov/cfgov/settings/base.py b/cfgov/cfgov/settings/base.py index d65e2f3a6f4..a040298cbf0 100644 --- a/cfgov/cfgov/settings/base.py +++ b/cfgov/cfgov/settings/base.py @@ -485,6 +485,7 @@ CSP_OBJECT_SRC = ("'none'") CSP_BASE_URI = ("'none'") CSP_INCLUDE_NONCE_IN = ["script-src"] +CSP_EXCLUDE_URL_PREFIXES = ("/admin") # FEATURE FLAGS # Flags can be declared here with an empty list, which will evaluate as false diff --git a/cfgov/wagtailadmin_overrides/templates/wagtailadmin/userbar/base.html b/cfgov/wagtailadmin_overrides/templates/wagtailadmin/userbar/base.html new file mode 100644 index 00000000000..80299cd7e64 --- /dev/null +++ b/cfgov/wagtailadmin_overrides/templates/wagtailadmin/userbar/base.html @@ -0,0 +1,41 @@ +{% load wagtailadmin_tags i18n %} + + + + + + From bfc4bef91066adf09c6510febe60ec1801e2906b Mon Sep 17 00:00:00 2001 From: Wyatt Pearsall Date: Tue, 1 Oct 2024 10:22:18 -0700 Subject: [PATCH 3/3] Added nonce example to docs --- docs/editing-components.md | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/docs/editing-components.md b/docs/editing-components.md index dcb9fefeb67..a0f7f483378 100644 --- a/docs/editing-components.md +++ b/docs/editing-components.md @@ -316,6 +316,21 @@ see [Notes on Atomic Design](atomic-structure.md).) This will load the `related-content.js` script on any page that includes the `RelatedContent` molecule in one of its StreamFields. +If adding Javascript directly with a script tag is required, you'll need to add a `nonce` attribute with the value `{{request.csp_nonce}}`. This +is due to our use of `strict-dynamic` in our Content Security Policy via [django-csp](https://django-csp.readthedocs.io/en/3.8/nonce.html). +Here's an example from the [records-access-form template](https://github.com/cfpb/consumerfinance.gov/blob/main/cfgov/privacy/jinja2/privacy/records-access-form.html): + +```javascript +{% block javascript %} + {{ super() }} + +{% endblock javascript %} +``` + +You'll note this uses our asynchronous javascript loaderi (jsl), which is also how js in the Media classes of components are loaded. + ## How-to guides ### Creating a new component