Feat/csp check #205
Merged
Feat/csp check #205
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
kwajiehao
suggested changes
Nov 9, 2020
…es csp, cleans up console logging, cleans up variable names, and cleans up test code
…tures html and sanitizing before rendering
…ration for supporting child-src and script-src-elem cases
…licy object on each render
gweiying
force-pushed
the
feat/csp-check
branch
from
e2a0148 to
bb83164
Compare
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR introduces utilities to check editor markdown content for unsupported elements in EditPage, resolving #179.
Implementation
At a high level, this is done by first retrieving and parsing the
netlify.tomlfile from the website repo to extract the CSP for the repo. The user-edited markdown content is compiled into html, and inspected for any elements that violate the CSP. The violating elements are replaced with an error message, and the Save button is disabled until the user resolves the error message. An example of this is shown in the screenshot below.Details
The CSP of a website specifies accepted sources for scripts on the website. Only scripts received from domains specified in the respective fetch directives can executed on the website. Currently, only 5 fetch directives and their fallbacks are supported in our CSP checking,
frame-src,img-src,script-elem-src,object-src,media-src.For each fetch directives, the types of html elements restricted are as follows:
frame-src:frame,iframeimg-src:imgmedia-src:audio,video,trackobject-src:object,embed,appletscript-src-elem:scriptFor example, with a
media-srcpolicy of'none',<audio src="animal.mp3" controls></audio>will be considered a violating element.If the
frame-srcis not specified, the checker falls back to thechild-srcpolicy value (link1 [link2])(http://csplite.com/csp/test121/), and defaults todefault-srcifchild-srcis not specified either. Similarly, ifscript-src-elemis not specified,script-src-elemfalls back toscript-srcand defaults todefault-srcifscript-srcis not specified. All other fetch directives default automatically todefault-srcif not specified.