From mboxrd@z Thu Jan 1 00:00:00 1970
From: Peter =?utf-8?q?M=C3=BCller?= <peter.mueller@link38.eu>
To: development@lists.ipfire.org
Subject: [PATCH] prevent loading resources from external sites
Date: Sun, 03 Dec 2017 20:34:02 +0100
Message-ID: <20171203203402.0bbeaa78.peter.mueller@link38.eu>
MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="===============9177497671645848800=="
List-Id: <development.lists.ipfire.org>
--===============9177497671645848800==
Content-Type: text/plain; charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Make Apache transmit a CSP (Content Security Policy) header
for WebUI and Captive Portal contents.
This prevents some XSS and content injection attacks, especially
in case no transport encryption (Captive Portal!) can be used.
Signed-off-by: Peter M=C3=BCller <peter.mueller(a)link38.eu>
---
config/httpd/vhosts.d/captive.conf | 2 ++
config/httpd/vhosts.d/ipfire-interface-ssl.conf | 2 ++
config/httpd/vhosts.d/ipfire-interface.conf | 2 ++
3 files changed, 6 insertions(+)
diff --git a/config/httpd/vhosts.d/captive.conf b/config/httpd/vhosts.d/capti=
ve.conf
index e4e1d78f1..2640654fd 100644
--- a/config/httpd/vhosts.d/captive.conf
+++ b/config/httpd/vhosts.d/captive.conf
@@ -9,6 +9,8 @@ Listen 1013
# code was entered.
KeepAlive Off
=20
+ Header always set Content-Security-Policy "default-src 'self'; script-src '=
self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
+
ScriptAlias /cgi-bin/ /srv/web/ipfire/cgi-bin/captive/
Alias /assets/ /srv/web/ipfire/html/captive/assets/
=20
diff --git a/config/httpd/vhosts.d/ipfire-interface-ssl.conf b/config/httpd/v=
hosts.d/ipfire-interface-ssl.conf
index dacf6a005..e7eb6c041 100644
--- a/config/httpd/vhosts.d/ipfire-interface-ssl.conf
+++ b/config/httpd/vhosts.d/ipfire-interface-ssl.conf
@@ -18,6 +18,8 @@
SSLCertificateFile /etc/httpd/server-ecdsa.crt
SSLCertificateKeyFile /etc/httpd/server-ecdsa.key
=20
+ Header always set Content-Security-Policy "default-src 'self'; script-sr=
c 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
+
<Directory /srv/web/ipfire/html>
Options ExecCGI
AllowOverride None
diff --git a/config/httpd/vhosts.d/ipfire-interface.conf b/config/httpd/vhost=
s.d/ipfire-interface.conf
index be15cd041..abc36a61a 100644
--- a/config/httpd/vhosts.d/ipfire-interface.conf
+++ b/config/httpd/vhosts.d/ipfire-interface.conf
@@ -6,6 +6,8 @@
RewriteCond %{REQUEST_METHOD} ^(TRACE|TRACK|OPTIONS)
RewriteRule .* - [F]
=20
+ Header always set Content-Security-Policy "default-src 'self'; script-sr=
c 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'"
+
<Directory /srv/web/ipfire/html>
Options ExecCGI
AllowOverride None
--=20
2.13.6
--===============9177497671645848800==--