feat: add more fine-grained CSP support #3724

janl · 2021-09-02T10:07:50Z

This introduces CSP settings for attachments and show/list funs and
streamlines the configuration with the existing Fauxton CSP options.

Deprecates the old [csp] enable and [csp] header_value config
options, but they are honoured going forward.

They are replaced with [csp] utils_enable and [csp] utils_header_value
respectively. The funcitonality and default values remain the same.

In addition, these new config options are added, along with their
default values:

[csp]
attachments_enable = true
attachments_header_value = sandbox
showlist_enable = true
showlist_header_value = sandbox

These add Content-Security-Policy headers to all attachment requests
and to all non-JSON show and all list function responses.

Co-authored-by: Nick Vatamaniuc [email protected]
Co-authored-by: Robert Newson [email protected]

Checklist

Code is written and works correctly
Changes are covered by tests
Any new configurable parameters are documented in rel/overlay/etc/default.ini
A PR for documentation changes has been made in https://github.com/apache/couchdb-documentation

src/chttpd/src/chttpd_util.erl

src/chttpd/test/eunit/chttpd_db_test.erl

src/chttpd/src/chttpd_util.erl

src/chttpd/test/eunit/chttpd_csp_tests.erl

nickva

+1 with a few minor nits in tests

janl · 2021-09-08T11:13:14Z

Thanks Nick, should be all addressed

This introduces CSP settings for attachments and show/list funs and streamlines the configuration with the existing Fauxton CSP options. Deprecates the old `[csp] enable` and `[csp] header_value` config options, but they are honoured going forward. They are replaced with `[csp] utils_enable` and `[csp] utils_header_value` respectively. The funcitonality and default values remain the same. In addition, these new config options are added, along with their default values: ``` [csp] attachments_enable = true attachments_header_value = sandbox showlist_enable = true showlist_header_value = sandbox ``` These add `Content-Security-Policy` headers to all attachment requests and to all non-JSON show and all list function responses. Co-authored-by: Nick Vatamaniuc <[email protected]> Co-authored-by: Robert Newson <[email protected]>

janl force-pushed the feat/csp-for-attachments branch 2 times, most recently from d043396 to 3c20cc2 Compare September 2, 2021 10:38