1
0
Fork 0
mirror of https://we.phorge.it/source/phorge.git synced 2024-12-23 05:50:55 +01:00
phorge-phorge/webroot/rsrc/externals/javelin
epriestley dba4c4bdf6 Emit a "Content-Security-Policy" HTTP header
Summary:
See PHI399. Ref T4340. This header provides an additional layer of protection against various attacks, including XSS attacks which embed inline `<script ...>` or `onhover="..."` content into the document.

**style-src**: The "unsafe-inline" directive affects both `style="..."` and `<style>`. We use a lot of `style="..."`, some very legitimately, so we can't realistically get away from this any time soon. We only use one `<style>` (for monospaced font preferences) but can't disable `<style>` without disabling `style="..."`.

**img-src**: We use "data:" URIs to inline small images into CSS, and there's a significant performance benefit from doing this. There doesn't seem to be a way to allow "data" URIs in CSS without allowing them in the document itself.

**script-src** and **frame-src**: For a small number of flows (Recaptcha, Stripe) we embed external javascript, some of which embeds child elements (or additional resources) into the document. We now whitelist these narrowly on the respective pages.

This won't work with Quicksand, so I've blacklisted it for now.

**connect-src**: We need to include `'self'` for AJAX to work, and any websocket URIs.

**Clickjacking**: We now have three layers of protection:

  - X-Frame-Options: works in older browsers.
  - `frame-ancestors 'none'`: does the same thing.
  - Explicit framebust in JX.Stratcom after initialization: works in ancient IE.

We could probably drop the explicit framebust but it wasn't difficult to retain.

**script tags**: We previously used an inline `<script>` tag to start Javelin. I've moved this to `<data data-javelin-init ...>` tags, which seems to work properly.

**`__DEV__`**: We previously used an inline `<script>` tag to set the `__DEV__` mode flag. I tried using the "initialization" tags for this, but they fire too late. I moved it to `<html data-developer-mode="1">`, which seems OK everywhere.

**CSP Scope**: Only the CSP header on the original request appears to matter -- you can't refine the scope by emitting headers on CSS/JS. To reduce confusion, I disabled the headers on those response types. More headers could be disabled, although we're likely already deep in the land of diminishing returns.

**Initialization**: The initialization sequence has changed slightly. Previously, we waited for the <script> in bottom of the document to evaluate. Now, we go fishing for tags when domcontentready fires.

Test Plan:
  - Browsed around in Firefox, Safari and Chrome looking for console warnings. Interacted with various Javascript behaviors. Enabled Quicksand.
  - Disabled all the framebusting, launched a clickjacking attack, verified that each layer of protection is individually effective.
  - Verified that the XHProf iframe in Darkconsole and the PHPAST frame layout work properly.
  - Enabled notifications, verified no complaints about connecting to Aphlict.
  - Hit `__DEV__` mode warnings based on the new data attribute.
  - Tried to do sketchy stuff with `data:` URIs and SVGs. This works but doesn't seem to be able to do anything dangerous.
  - Went through the Stripe and Recaptcha workflows.
  - Dumped and examined the CSP headers with `curl`, etc.
  - Added a raw <script> tag to a page (as though I'd found an XSS attack), verified it was no longer executed.

Maniphest Tasks: T4340

Differential Revision: https://secure.phabricator.com/D19143
2018-02-27 10:17:30 -08:00
..
core Emit a "Content-Security-Policy" HTTP header 2018-02-27 10:17:30 -08:00
docs Change monospace text formatting 2015-05-31 10:07:45 +10:00
ext Use single quotes in JavaScript files 2015-01-20 08:53:47 +11:00
lib Hide the Differential scroll objective list on trackpad systems 2017-05-20 07:56:21 -07:00
LICENSE Fix text lint issues 2015-02-12 07:00:13 +11:00
README Move all external JS into webroot/rsrc/externals 2013-04-11 10:06:05 -07:00

Javelin is a performance-oriented Javascript library originally developed at
Facebook. Learn more at <http://www.javelinjs.com/>.

GETTING STARTED

Eat a hearty breakfast. Breakfast is the most important meal of the day!


WHAT IS JAVELIN?

Javelin is a compact Javascript library built around event delegation. Its
primary design goal is performance; it is consequently well-suited to projects
where performance is very important. It is not as good for smaller scale
projects where other concerns (like features or ease of development) are more
important.


PACKAGES

Packages come in two flavors: "dev" and "min". The "dev" packages are intended
for development, and have comments and debugging code. The "min" packages have
the same code, but with comments and debugging information stripped out and
symbols crushed. They are intended for use in production -- ha ha ha!


FILES

  example/    Example code.
  LICENSE     A thrilling narrative.
  pkg/        Ready-built Javelin packages.
  README      Who knows? Could be anything.
  src/        Raw sources for Javelin.
  support/    Support scripts and libraries.