Skip to content

Update csp #3919

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Sep 19, 2025
Merged

Update csp #3919

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions .kontinuous/values.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -171,7 +171,7 @@ frontend:
containerPort: 8080
ingress:
customHeaders:
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so"
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' 'unsafe-inline' https://*.gouv.fr https://tally.so https://*.tally.so"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding 'unsafe-inline' to style-src weakens the CSP security posture by allowing inline styles, which can be exploited for XSS attacks. Consider:

  1. Document why this change is necessary
  2. Explore alternatives like using nonces or hashes for specific inline styles
  3. Ensure proper input sanitization for any user-generated content that could contain styles
  4. Consider if this can be scoped to specific style sources rather than allowing all inline styles

If this is required for a specific library or framework, document which one and consider more restrictive alternatives.

"X-Frame-Options": "deny"
"X-Content-Type-Options": "nosniff"
"X-XSS-Protection": "0"
Expand All @@ -195,7 +195,7 @@ portail-admins:
host: "admin-{{ .Values.global.host }}"
ingress:
customHeaders:
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr; font-src 'self'; img-src 'self' data:; script-src 'self' https://*.gouv.fr; frame-src 'self' https://*.gouv.fr; style-src 'self' https://*.gouv.fr"
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr; font-src 'self'; img-src 'self' data:; script-src 'self' https://*.gouv.fr; frame-src 'self' https://*.gouv.fr; style-src 'self' 'unsafe-inline' https://*.gouv.fr"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same security concern as the frontend service - 'unsafe-inline' in style-src creates potential XSS vulnerabilities. This is particularly concerning for the admin portal which likely handles sensitive administrative operations. Consider if this change is absolutely necessary for the admin interface and explore safer alternatives.

"X-Frame-Options": "deny"
"X-Robots-Tag": "noindex, nofollow, nosnippet, noarchive"
"X-Content-Type-Options": "nosniff"
Expand All @@ -214,7 +214,7 @@ portail-usagers:
host: "mon-{{ .Values.global.host }}"
ingress:
customHeaders:
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so"
"Content-Security-Policy": "default-src 'none'; manifest-src 'self' https://*.gouv.fr; connect-src 'self' https://*.gouv.fr https://api.tally.so https://*.tally.so; font-src 'self' https://fonts.gstatic.com https://tally.so https://*.tally.so; img-src 'self' https://tally.so https://*.tally.so data:; script-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; frame-src 'self' https://*.gouv.fr https://tally.so https://*.tally.so; style-src 'self' 'unsafe-inline' https://*.gouv.fr https://tally.so https://*.tally.so"
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Adding 'unsafe-inline' to the user portal's CSP also introduces security risks. Since this portal likely handles user-generated content and personal data, the security implications are significant. Ensure this change is properly justified and documented, and consider implementing additional security measures to compensate for the weakened CSP.

"X-Frame-Options": "deny"
"X-Content-Type-Options": "nosniff"
"X-XSS-Protection": "0"
Expand Down
Loading