govuk_app_config 1.13.1 → 1.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: e6504742fa233df08c6151c4a208b81d74c0e86fc66ec44c9e674411757f1b06
-  data.tar.gz: 0d81b49c65c5b4c7471779cbbf2f3af69e8f1fe0106fc5e1882ecb8d1c6202a0
+  metadata.gz: a128bd40ec0db6c4e7b792fc2c24cbdc31c1aff62a5be05a04d279da4ebf502b
+  data.tar.gz: 890eebef66ab4e625f7a8c34fe3dfeed9b39a3d1f83ec48d3ca71a7f1f286c0b
 SHA512:
-  metadata.gz: 794bf46ad9898b4c7575c8af262bde589b1bffe415e81fc7fd8689e63c7632cba8cdb86a4dc1a25e21cd14433d35ef6c6c84e4108fcdb6011f4ebb773d302f53
-  data.tar.gz: bf19a658cbe74231b2c72871e4a6f2f078d1b1525ff52ea814bd2c89941fbec2091920a299ca8e127e6b4ce21810ab784f1bec7ff5e8e2bb33f90883eea27d80
+  metadata.gz: f03074bb2adf21510b86ec9786bdd205f65cd2bbc4d8e1fe94f01f5f2c33d9b3c060ce612b919ceccdf607b58f1118db6cb3da0395a438cba30ec3a38978fc42
+  data.tar.gz: cdec791c828fb80e08bba9bac8118a324b6b3e472613b46aa30f4bc921c3ec982da559d6d089258cdfe1506925ff3987ed55818bcf4f781d037587b5a80b2c2f

data/CHANGELOG.md

@@ -1,3 +1,7 @@
+# 1.14.0
+
+* Add content security policy support.
+
 # 1.13.1
 
 * Remove formating from the Logstasher logger, used by default for the

data/README.md

@@ -6,6 +6,7 @@ Adds the basics of a GOV.UK application:
 - Error reporting with Sentry
 - Statsd client for reporting stats
 - Rails logging
+- Content Security Policy generation for frontend apps
 
 ## Installation
 
@@ -115,6 +116,19 @@ check docs](docs/healthchecks.md) for more information on how to use it.
 In Rails applications, the application will be configured to send JSON-formatted
 logs to `STDOUT` and unstructed logs to `STDERR`.
 
+## Content Security Policy generation
+
+For frontend apps, configuration can be added to generate and serve a
+content security policy header. The policy is report only when the Rails
+environment is set to "production", and enforced otherwise.
+
+To enable this feature, create a file at `config/initializers/csp.rb` in the
+app with the following content:
+
+```ruby
+GovukContentSecurityPolicy.configure
+```
+
 ## License
 
 [MIT License](LICENSE.md)

data/lib/govuk_app_config.rb

@@ -1,4 +1,5 @@
 require "govuk_app_config/version"
+require "govuk_app_config/govuk_content_security_policy"
 require "govuk_app_config/govuk_statsd"
 require "govuk_app_config/govuk_error"
 require "govuk_app_config/govuk_logging"

data/lib/govuk_app_config/govuk_content_security_policy.rb

@@ -0,0 +1,138 @@
+module GovukContentSecurityPolicy
+  # Generate a Content Security Policy (CSP) directive.
+  #
+  #
+  # Extracted in a separate module to allow comments.
+  #
+  # See https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP for more CSP info.
+  #
+  # The resulting policy should be checked with:
+  #
+  # - https://csp-evaluator.withgoogle.com
+  # - https://cspvalidator.org
+
+  GOVUK_DOMAINS = "'self' *.publishing.service.gov.uk localhost".freeze
+
+  GOOGLE_ANALYTICS_DOMAINS = "www.google-analytics.com ssl.google-analytics.com".freeze
+
+  def self.build
+    policies = []
+
+    # By default, only allow HTTPS connections, and allow loading things from
+    # the publishing domain
+    #
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
+    policies << [
+      "default-src https",
+      GOVUK_DOMAINS
+    ]
+
+    # Allow images from the current domain, Google Analytics (the tracking pixel),
+    # and publishing domains.
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
+    policies << [
+      "img-src",
+
+      # Allow `data:` images for Base64-encoded images in CSS like:
+      #
+      # https://github.com/alphagov/service-manual-frontend/blob/1db99ed48de0dfc794b9686a98e6c62f8435ae80/app/assets/stylesheets/modules/_search.scss#L106
+      "data:",
+
+      GOVUK_DOMAINS,
+      GOOGLE_ANALYTICS_DOMAINS,
+
+      # Some content still links to an old domain we used to use
+      "assets.digital.cabinet-office.gov.uk",
+    ]
+
+    # script-src determines the scripts that the browser can load
+    #
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
+    policies << [
+      # Allow scripts from publishing domains
+      "script-src",
+      GOVUK_DOMAINS,
+      GOOGLE_ANALYTICS_DOMAINS,
+
+      # Allow JSONP call to Verify to check whether the user is logged in
+      # https://www.staging.publishing.service.gov.uk/log-in-file-self-assessment-tax-return/sign-in/prove-identity
+      # https://github.com/alphagov/government-frontend/blob/71aca4df9b74366618a5a93acdb5cd2715f94f49/app/assets/javascripts/modules/track-radio-group.js
+      "www.signin.service.gov.uk",
+
+      # Allow YouTube Embeds (Govspeak turns YouTube links into embeds)
+      "*.ytimg.com",
+      "www.youtube.com",
+
+      # Allow all inline scripts until we can conclusively document all the inline scripts we use,
+      # and there's a better way to filter out junk reports
+      "'unsafe-inline'"
+    ]
+
+    # Allow styles from own domain and publishing domains.
+    #
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
+    policies << [
+      "style-src",
+      GOVUK_DOMAINS,
+
+      # Also allow "unsafe-inline" styles, because we use the `style=""` attribute on some HTML elements
+      "'unsafe-inline'"
+    ]
+
+    # Allow fonts to be loaded from data-uri's (this is the old way of doing things)
+    # or from the publishing asset domains.
+    #
+    # https://www.staging.publishing.service.gov.uk/apply-for-a-licence/test-licence/westminster/apply-1
+    #
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
+    policies << [
+      "font-src data:",
+      GOVUK_DOMAINS
+    ]
+
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/connect-src
+    policies << [
+      # Scripts can only load data using Ajax from Google Analytics and the publishing domains
+      "connect-src",
+      GOVUK_DOMAINS,
+      GOOGLE_ANALYTICS_DOMAINS,
+
+      # Allow connecting to web chat from HMRC contact pages like
+      # https://www.staging.publishing.service.gov.uk/government/organisations/hm-revenue-customs/contact/child-benefit
+      "www.tax.service.gov.uk",
+
+      # Allow connecting to Verify to check whether the user is logged in
+      # https://github.com/alphagov/government-frontend/blob/71aca4df9b74366618a5a93acdb5cd2715f94f49/app/assets/javascripts/modules/track-radio-group.js
+      # https://www.staging.publishing.service.gov.uk/log-in-file-self-assessment-tax-return/sign-in/prove-identity
+      "www.signin.service.gov.uk",
+    ]
+
+    # Disallow all <object>, <embed>, and <applet> elements
+    #
+    # https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/object-src
+    policies << [
+      "object-src 'none'"
+    ]
+
+    policies << [
+      "frame-src",
+
+      # Allow YouTube embeds
+      "www.youtube.com",
+    ]
+
+    policies.map { |str| str.join(" ") }.join("; ") + ";"
+  end
+
+  def self.configure
+    # In test and development, use CSP for real to find issues. In production we only
+    # report violations to Sentry (https://sentry.io/govuk/govuk-frontend-csp) via an
+    # AWS Lambda function that filters out junk reports.
+    if Rails.env.production?
+      reporting = "report-uri https://jhpno0hk6b.execute-api.eu-west-2.amazonaws.com/production"
+      Rails.application.config.action_dispatch.default_headers['Content-Security-Policy-Report-Only'] = GovukContentSecurityPolicy.build + " " + reporting
+    else
+      Rails.application.config.action_dispatch.default_headers['Content-Security-Policy'] = GovukContentSecurityPolicy.build
+    end
+  end
+end

data/lib/govuk_app_config/version.rb

@@ -1,3 +1,3 @@
 module GovukAppConfig
-  VERSION = "1.13.1"
+  VERSION = "1.14.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: govuk_app_config
 version: !ruby/object:Gem::Version
-  version: 1.13.1
+  version: 1.14.0
 platform: ruby
 authors:
 - GOV.UK Dev
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2019-03-28 00:00:00.000000000 Z
+date: 2019-04-05 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: aws-xray-sdk
@@ -200,6 +200,7 @@ files:
 - govuk_app_config.gemspec
 - lib/govuk_app_config.rb
 - lib/govuk_app_config/configure.rb
+- lib/govuk_app_config/govuk_content_security_policy.rb
 - lib/govuk_app_config/govuk_error.rb
 - lib/govuk_app_config/govuk_healthcheck.rb
 - lib/govuk_app_config/govuk_healthcheck/active_record.rb