includes/ContentSecurityPolicy.php

   1 <?php
   2 /**
   3  * Handle sending Content-Security-Policy headers
   4  *
   5  * @see https://www.w3.org/TR/CSP2/
   6  *
   7  * Copyright © 2015–2018 Brian Wolff
   8  *
   9  * This program is free software; you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation; either version 2 of the License, or
  12  * (at your option) any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License along
  20  * with this program; if not, write to the Free Software Foundation, Inc.,
  21  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  22  * http://www.gnu.org/copyleft/gpl.html
  23  *
  24  * @since 1.32
  25  * @file
  26  */
  27 class ContentSecurityPolicy {
  28         const REPORT_ONLY_MODE = 1;
  29         const FULL_MODE = 2;
  30         /** Used for meta tag. Does not include report urls or nonce sources */
  31         const FULL_MODE_RESTRICTED = 3;
  32
  33         /** @var string The nonce to use for inline scripts (from OutputPage) */
  34         private $nonce;
  35         /** @var Config The site configuration object */
  36         private $mwConfig;
  37         /** @var WebResponse */
  38         private $response;
  39
  40         /**
  41          * @param string $nonce
  42          * @param WebResponse $response
  43          * @param Config $mwConfig
  44          */
  45         public function __construct( $nonce, WebResponse $response, Config $mwConfig ) {
  46                 $this->nonce = $nonce;
  47                 $this->response = $response;
  48                 $this->mwConfig = $mwConfig;
  49         }
  50
  51         /**
  52          * Send a single CSP header based on a given policy config.
  53          *
  54          * @note Most callers will probably want ContentSecurityPolicy::sendHeaders() instead.
  55          * @param array $csp ContentSecurityPolicy configuration
  56          * @param int $reportOnly self::*_MODE constant
  57          */
  58         public function sendCSPHeader( $csp, $reportOnly ) {
  59                 $policy = $this->makeCSPDirectives( $csp, $reportOnly );
  60                 $headerName = $this->getHeaderName( $reportOnly );
  61                 if ( $policy ) {
  62                         $this->response->header(
  63                                 "$headerName: $policy"
  64                         );
  65                 }
  66         }
  67
  68         /**
  69          * Return the meta header to use for after load restricted mode
  70          *
  71          * This should restrict browsers that don't support nonce-sources.
  72          * Idea stolen from
  73          * https://blogs.dropbox.com/tech/2015/09/unsafe-inline-and-nonce-deployment/
  74          *
  75          * @param array $csp CSP configuration
  76          * @return string Content for meta tag
  77          */
  78         public function getMetaHeader( $csp ) {
  79                 return $this->makeCSPDirectives( $csp, self::FULL_MODE_RESTRICTED );
  80         }
  81
  82         /**
  83          * Send CSP headers based on wiki config
  84          *
  85          * Main method that callers are expected to use
  86          * @param IContextSource $context A context object, the associated OutputPage
  87          *  object must be the one that the page in question was generated with.
  88          */
  89         public static function sendHeaders( IContextSource $context ) {
  90                 $out = $context->getOutput();
  91                 $csp = new ContentSecurityPolicy(
  92                         $out->getCSPNonce(),
  93                         $context->getRequest()->response(),
  94                         $context->getConfig()
  95                 );
  96
  97                 $cspConfig = $context->getConfig()->get( 'CSPHeader' );
  98                 $cspConfigReportOnly = $context->getConfig()->get( 'CSPReportOnlyHeader' );
  99
 100                 $csp->sendCSPHeader( $cspConfig, self::FULL_MODE );
 101                 $csp->sendCSPHeader( $cspConfigReportOnly, self::REPORT_ONLY_MODE );
 102
 103                 // Include <meta> header which increases security level after initial load.
 104                 // This helps mitigate attacks on browsers not supporting CSP2. It also
 105                 // helps mitigate attacks due to the shared nonce that non-logged in users
 106                 // get due to varnish cache.
 107                 // Unclear if this is the best place to insert the meta tag, or if
 108                 // it should be in a RL module. I figure its best to do this as early
 109                 // as possible.
 110                 // FIXME: Needs testing to see if this actually works properly
 111                 $metaHeader = $csp->getMetaHeader( $cspConfig );
 112                 if ( $metaHeader ) {
 113                         $context->getOutput()->addScript(
 114                                 ResourceLoader::makeInlineScript(
 115                                         $csp->makeMetaInsertScript(
 116                                                 $metaHeader
 117                                         ),
 118                                         $out->getCSPNonce()
 119                                 )
 120                         );
 121                 }
 122         }
 123
 124         /**
 125          * Makes javascript to insert a meta CSP header after page load
 126          *
 127          * @see https://blogs.dropbox.com/tech/2015/09/unsafe-inline-and-nonce-deployment/
 128          * @param string $metaContents content of meta tag
 129          * @return string JS for including in page
 130          */
 131         private function makeMetaInsertScript( $metaContents ) {
 132                 return "$('\\x3Cmeta http-equiv=\"Content-Security-Policy\"\\x3E')" .
 133                         '.attr("content",' .
 134                         Xml::encodeJsVar( $metaContents ) .
 135                         ').prependTo($("head"))';
 136         }
 137
 138         /**
 139          * Get the name of the HTTP header to use.
 140          *
 141          * @param int $reportOnly Either self::REPORT_ONLY_MODE or self::FULL_MODE
 142          * @return string Name of http header
 143          * @throws UnexpectedValueException if you feed it self::FULL_MODE_RESTRICTED.
 144          */
 145         private function getHeaderName( $reportOnly ) {
 146                 if ( $reportOnly === self::REPORT_ONLY_MODE ) {
 147                         return 'Content-Security-Policy-Report-Only';
 148                 } elseif ( $reportOnly === self::FULL_MODE ) {
 149                         return 'Content-Security-Policy';
 150                 }
 151                 throw new UnexpectedValueException( $reportOnly );
 152         }
 153
 154         /**
 155          * Determine what CSP policies to set for this page
 156          *
 157          * @param array|bool $config Policy configuration (Either $wgCSPHeader or $wgCSPReportOnlyHeader)
 158          * @param int $mode self::REPORT_ONLY_MODE, self::FULL_MODE or Self::FULL_MODE_RESTRICTED
 159          * @return string Policy directives, or empty string for no policy.
 160          */
 161         private function makeCSPDirectives( $policyConfig, $mode ) {
 162                 if ( $policyConfig === false ) {
 163                         // CSP is disabled
 164                         return '';
 165                 }
 166                 if ( $policyConfig === true ) {
 167                         $policyConfig = [];
 168                 }
 169
 170                 $mwConfig = $this->mwConfig;
 171
 172                 $additionalSelfUrls = $this->getAdditionalSelfUrls();
 173                 $additionalSelfUrlsScript = $this->getAdditionalSelfUrlsScript();
 174                 $nonceSrc = "'nonce-" . $this->nonce . "'";
 175
 176                 // If no default-src is sent at all, it
 177                 // seems browsers (or at least some), interpret
 178                 // that as allow anything, but the spec seems
 179                 // to imply that data: and blob: should be
 180                 // blocked.
 181                 $defaultSrc = [ '*', 'data:', 'blob:' ];
 182
 183                 $cssSrc = false;
 184                 $imgSrc = false;
 185                 $scriptSrc = [ "'unsafe-eval'", "'self'" ];
 186                 if ( $mode !== self::FULL_MODE_RESTRICTED ) {
 187                         $scriptSrc[] = $nonceSrc;
 188                 }
 189                 $scriptSrc = array_merge( $scriptSrc, $additionalSelfUrlsScript );
 190                 if ( isset( $policyConfig['script-src'] )
 191                         && is_array( $policyConfig['script-src'] )
 192                 ) {
 193                         foreach ( $policyConfig['script-src'] as $src ) {
 194                                 $scriptSrc[] = $this->escapeUrlForCSP( $src );
 195                         }
 196                 }
 197                 // Note: default on if unspecified.
 198                 if ( ( !isset( $policyConfig['unsafeFallback'] )
 199                         || $policyConfig['unsafeFallback'] )
 200                         && $mode !== self::FULL_MODE_RESTRICTED
 201                 ) {
 202                         // unsafe-inline should be ignored on browsers
 203                         // that support 'nonce-foo' sources.
 204                         // Some older versions of firefox don't follow this
 205                         // rule, but new browsers do. (Should be for at least
 206                         // firefox 40+).
 207                         $scriptSrc[] = "'unsafe-inline'";
 208                 }
 209                 // If default source option set to true or
 210                 // an array of urls, set a restrictive default-src.
 211                 // If set to false, we send a lenient default-src,
 212                 // see the code above where $defaultSrc is set initially.
 213                 if ( isset( $policyConfig['default-src'] )
 214                         && $policyConfig['default-src'] !== false
 215                 ) {
 216                         $defaultSrc = array_merge(
 217                                 [ "'self'", 'data:', 'blob:' ],
 218                                 $additionalSelfUrls
 219                         );
 220                         if ( is_array( $policyConfig['default-src'] ) ) {
 221                                 foreach ( $policyConfig['default-src'] as $src ) {
 222                                         $defaultSrc[] = $this->escapeUrlForCSP( $src );
 223                                 }
 224                         }
 225                 }
 226
 227                 if ( !isset( $policyConfig['includeCORS'] ) || $policyConfig['includeCORS'] ) {
 228                         $CORSUrls = $this->getCORSSources();
 229                         if ( !in_array( '*', $defaultSrc ) ) {
 230                                 $defaultSrc = array_merge( $defaultSrc, $CORSUrls );
 231                         }
 232                         // Unlikely to have * in scriptSrc, but doesn't
 233                         // hurt to check.
 234                         if ( !in_array( '*', $scriptSrc ) ) {
 235                                 $scriptSrc = array_merge( $scriptSrc, $CORSUrls );
 236                         }
 237                 }
 238
 239                 Hooks::run( 'ContentSecurityPolicyDefaultSource', [ &$defaultSrc, $policyConfig, $mode ] );
 240                 Hooks::run( 'ContentSecurityPolicyScriptSource', [ &$scriptSrc, $policyConfig, $mode ] );
 241
 242                 // Check if array just in case the hook made it false
 243                 if ( is_array( $defaultSrc ) ) {
 244                         $cssSrc = array_merge( $defaultSrc, [ "'unsafe-inline'" ] );
 245                 }
 246
 247                 if ( $mode === self::FULL_MODE_RESTRICTED ) {
 248                         // report-uri disallowed in <meta> tags.
 249                         $reportUri = false;
 250                 } elseif ( isset( $policyConfig['report-uri'] ) && $policyConfig['report-uri'] !== true ) {
 251                         if ( $policyConfig['report-uri'] === false ) {
 252                                 $reportUri = false;
 253                         } else {
 254                                 $reportUri = $this->escapeUrlForCSP( $policyConfig['report-uri'] );
 255                         }
 256                 } else {
 257                         $reportUri = $this->getReportUri( $mode );
 258                 }
 259
 260                 // Only send an img-src, if we're sending a restricitve default.
 261                 if ( !is_array( $defaultSrc )
 262                         || !in_array( '*', $defaultSrc )
 263                         || !in_array( 'data:', $defaultSrc )
 264                         || !in_array( 'blob:', $defaultSrc )
 265                 ) {
 266                         // A future todo might be to make the whitelist options only
 267                         // add all the whitelisted sites to the header, instead of
 268                         // allowing all (Assuming there is a small number of sites).
 269                         // For now, the external image feature disables the limits
 270                         // CSP puts on external images.
 271                         if ( $mwConfig->get( 'AllowExternalImages' )
 272                                 || $mwConfig->get( 'AllowExternalImagesFrom' )
 273                                 || $mwConfig->get( 'AllowImageTag' )
 274                         ) {
 275                                 $imgSrc = [ '*', 'data:', 'blob:' ];
 276                         } elseif ( $mwConfig->get( 'EnableImageWhitelist' ) ) {
 277                                 $whitelist = wfMessage( 'external_image_whitelist' )
 278                                         ->inContentLanguage()
 279                                         ->plain();
 280                                 if ( preg_match( '/^\s*[^\s#]/m', $whitelist ) ) {
 281                                         $imgSrc = [ '*', 'data:', 'blob:' ];
 282                                 }
 283                         }
 284                 }
 285
 286                 $directives = [];
 287                 if ( $scriptSrc ) {
 288                         $directives[] = 'script-src ' . implode( ' ', $scriptSrc );
 289                 }
 290                 if ( $defaultSrc ) {
 291                         $directives[] = 'default-src ' . implode( ' ', $defaultSrc );
 292                 }
 293                 if ( $cssSrc ) {
 294                         $directives[] = 'style-src ' . implode( ' ', $cssSrc );
 295                 }
 296                 if ( $imgSrc ) {
 297                         $directives[] = 'img-src ' . implode( ' ', $imgSrc );
 298                 }
 299                 if ( $reportUri ) {
 300                         $directives[] = 'report-uri ' . $reportUri;
 301                 }
 302
 303                 Hooks::run( 'ContentSecurityPolicyDirectives', [ &$directives, $policyConfig, $mode ] );
 304
 305                 return implode( '; ', $directives );
 306         }
 307
 308         /**
 309          * Get the default report uri.
 310          *
 311          * @param int $mode self::*_MODE constant. Do not use with self::FULL_MODE_RESTRICTED
 312          * @return string The URI to send reports to.
 313          * @throws UnexpectedValueException if given invalid mode.
 314          */
 315         private function getReportUri( $mode ) {
 316                 if ( $mode === self::FULL_MODE_RESTRICTED ) {
 317                         throw new UnexpectedValueException( $mode );
 318                 }
 319                 $apiArguments = [
 320                         'action' => 'cspreport',
 321                         'format' => 'json'
 322                 ];
 323                 if ( $mode === self::REPORT_ONLY_MODE ) {
 324                         $apiArguments['reportonly'] = '1';
 325                 }
 326                 $reportUri = wfAppendQuery( wfScript( 'api' ), $apiArguments );
 327
 328                 // Per spec, ';' and ',' must be hex-escaped in report uri
 329                 // Also add an & at the end of url to work around bug in hhvm
 330                 // with handling of POST parameters when always_decode_post_data
 331                 // is set to true. See https://github.com/facebook/hhvm/issues/6676
 332                 $reportUri = $this->escapeUrlForCSP( $reportUri ) . '&';
 333                 return $reportUri;
 334         }
 335
 336         /**
 337          * Given a url, convert to form needed for CSP.
 338          *
 339          * Currently this does either scheme + host, or
 340          * if protocol relative, just the host. Future versions
 341          * could potentially preserve some of the path, if its determined
 342          * that that would be a good idea.
 343          *
 344          * @note This does the extra escaping for CSP, but assumes the url
 345          *   has already had normal url escaping applied.
 346          * @note This discards urls same as server name, as 'self' directive
 347          *   takes care of that.
 348          * @param string $url
 349          * @return string|bool Converted url or false on failure
 350          */
 351         private function prepareUrlForCSP( $url ) {
 352                 $result = false;
 353                 if ( preg_match( '/^[a-z][a-z0-9+.-]*:$/i', $url ) ) {
 354                         // A schema source (e.g. blob: or data:)
 355                         return $url;
 356                 }
 357                 $bits = wfParseUrl( $url );
 358                 if ( !$bits && strpos( $url, '/' ) === false ) {
 359                         // probably something like example.com.
 360                         // try again protocol-relative.
 361                         $url = '//' . $url;
 362                         $bits = wfParseUrl( $url );
 363                 }
 364                 if ( $bits && isset( $bits['host'] )
 365                         && $bits['host'] !== $this->mwConfig->get( 'ServerName' )
 366                 ) {
 367                         $result = $bits['host'];
 368                         if ( $bits['scheme'] !== '' ) {
 369                                 $result = $bits['scheme'] . $bits['delimiter'] . $result;
 370                         }
 371                         if ( isset( $bits['port'] ) ) {
 372                                 $result .= ':' . $bits['port'];
 373                         }
 374                         $result = $this->escapeUrlForCSP( $result );
 375                 }
 376                 return $result;
 377         }
 378
 379         /**
 380          * Get additional script sources
 381          *
 382          * @return array Additional sources for loading scripts from
 383          */
 384         private function getAdditionalSelfUrlsScript() {
 385                 $additionalUrls = [];
 386                 // wgExtensionAssetsPath for ?debug=true mode
 387                 $pathVars = [ 'LoadScript', 'ExtensionAssetsPath', 'ResourceBasePath' ];
 388
 389                 foreach ( $pathVars as $path ) {
 390                         $url = $this->mwConfig->get( $path );
 391                         $preparedUrl = $this->prepareUrlForCSP( $url );
 392                         if ( $preparedUrl ) {
 393                                 $additionalUrls[] = $preparedUrl;
 394                         }
 395                 }
 396                 $RLSources = $this->mwConfig->get( 'ResourceLoaderSources' );
 397                 foreach ( $RLSources as $wiki => $sources ) {
 398                         foreach ( $sources as $id => $value ) {
 399                                 $url = $this->prepareUrlForCSP( $value );
 400                                 if ( $url ) {
 401                                         $additionalUrls[] = $url;
 402                                 }
 403                         }
 404                 }
 405
 406                 return array_unique( $additionalUrls );
 407         }
 408
 409         /**
 410          * Get additional host names for the wiki (e.g. if static content loaded elsewhere)
 411          *
 412          * @note These are general load sources, not script sources
 413          * @return array Array of other urls for wiki (for use in default-src)
 414          */
 415         private function getAdditionalSelfUrls() {
 416                 // XXX on a foreign repo, the included description page can have anything on it,
 417                 // including inline scripts. But nobody sane does that.
 418
 419                 // In principle, you can have even more complex configs... (e.g. The urlsByExt option)
 420                 $pathUrls = [];
 421                 $additionalSelfUrls = [];
 422
 423                 // Future todo: The zone urls should never go into
 424                 // style-src. They should either be only in img-src, or if
 425                 // img-src unspecified they should be in default-src. Similarly,
 426                 // the DescriptionStylesheetUrl only needs to be in style-src
 427                 // (or default-src if style-src unspecified).
 428                 $callback = function ( $repo, &$urls ) {
 429                         $urls[] = $repo->getZoneUrl( 'public' );
 430                         $urls[] = $repo->getZoneUrl( 'transcoded' );
 431                         $urls[] = $repo->getZoneUrl( 'thumb' );
 432                         $urls[] = $repo->getDescriptionStylesheetUrl();
 433                 };
 434                 $localRepo = RepoGroup::singleton()->getRepo( 'local' );
 435                 $callback( $localRepo, $pathUrls );
 436                 RepoGroup::singleton()->forEachForeignRepo( $callback, [ &$pathUrls ] );
 437
 438                 // Globals that might point to a different domain
 439                 $pathGlobals = [ 'LoadScript', 'ExtensionAssetsPath', 'StylePath', 'ResourceBasePath' ];
 440                 foreach ( $pathGlobals as $path ) {
 441                         $pathUrls[] = $this->mwConfig->get( $path );
 442                 }
 443                 foreach ( $pathUrls as $path ) {
 444                         $preparedUrl = $this->prepareUrlForCSP( $path );
 445                         if ( $preparedUrl !== false ) {
 446                                 $additionalSelfUrls[] = $preparedUrl;
 447                         }
 448                 }
 449                 $RLSources = $this->mwConfig->get( 'ResourceLoaderSources' );
 450
 451                 foreach ( $RLSources as $wiki => $sources ) {
 452                         foreach ( $sources as $id => $value ) {
 453                                 $url = $this->prepareUrlForCSP( $value );
 454                                 if ( $url ) {
 455                                         $additionalSelfUrls[] = $url;
 456                                 }
 457                         }
 458                 }
 459
 460                 return array_unique( $additionalSelfUrls );
 461         }
 462
 463         /**
 464          * include domains that are allowed to send us CORS requests.
 465          *
 466          * Technically, $wgCrossSiteAJAXdomains lists things that are allowed to talk to us
 467          * not things that we are allowed to talk to - but if something is allowed to talk to us,
 468          * then there is a good chance that we should probably be allowed to talk to it.
 469          *
 470          * This is configurable with the 'includeCORS' key in the CSP config, and enabled
 471          * by default.
 472          * @note CORS domains with single character ('?') wildcards, are not included.
 473          * @return array Additional hosts
 474          */
 475         private function getCORSSources() {
 476                 $additionalUrls = [];
 477                 $CORSSources = $this->mwConfig->get( 'CrossSiteAJAXdomains' );
 478                 foreach ( $CORSSources as $source ) {
 479                         if ( strpos( $source, '?' ) !== false ) {
 480                                 // CSP doesn't support single char wildcard
 481                                 continue;
 482                         }
 483                         $url = $this->prepareUrlForCSP( $source );
 484                         if ( $url ) {
 485                                 $additionalUrls[] = $url;
 486                         }
 487                 }
 488                 return $additionalUrls;
 489         }
 490
 491         /**
 492          * CSP spec says ',' and ';' are not allowed to appear in urls.
 493          *
 494          * @note This assumes that normal escaping has been applied to the url
 495          * @param string $url URL (or possibly just part of one)
 496          * @return string
 497          */
 498         private function escapeUrlForCSP( $url ) {
 499                 return str_replace(
 500                         [ ';', ',' ],
 501                         [ '%3B', '%2C' ],
 502                         $url
 503                 );
 504         }
 505
 506         /**
 507          * Does this browser give false positive reports?
 508          *
 509          * Some versions of firefox (40-42) incorrectly report a csp
 510          * violation for nonce sources, despite allowing them.
 511          *
 512          * @see https://bugzilla.mozilla.org/show_bug.cgi?id=1026520
 513          * @param string $ua User-agent header
 514          * @return bool
 515          */
 516         public static function falsePositiveBrowser( $ua ) {
 517                 return (bool)preg_match( '!Firefox/4[0-2]\.!', $ua );
 518         }
 519
 520         /**
 521          * Is CSP currently enabled (i.e. Should we set nonce attribute)
 522          *
 523          * @param Config $config Configuration object
 524          * @return bool
 525          */
 526         public static function isEnabled( Config $config ) {
 527                 return $config->get( 'CSPHeader' ) !== false
 528                         || $config->get( 'CSPReportOnlyHeader' ) !== false;
 529         }
 530 }