erp5_web_js_style: add CSP/feature/referer policy tags

Use CSP to improve protection against XSS and improve user privacy. No javascript is supposed to be executed on the error page.

erp5_web_js_style: add CSP/feature/referer policy tags
Use CSP to improve protection against XSS and improve user privacy. No javascript is supposed to be executed on the error page.
298ef0f3 · Romain Courteaud · Xiaowu Zhang · bdf23784 · 298ef0f3 · 298ef0f3
Commit 298ef0f3 authored Nov 24, 2021 by Romain Courteaud Committed by Xiaowu Zhang Nov 30, 2021
3 changed files
--- a/bt5/erp5_web_js_style/SkinTemplateItem/portal_skins/erp5_web_js_style_ui/dialog_main.zpt
+++ b/bt5/erp5_web_js_style/SkinTemplateItem/portal_skins/erp5_web_js_style_ui/dialog_main.zpt
@@ -27,6 +27,9 @@
      <tal:block metal:use-macro="global_definitions_macros/header_definitions" />
 <html tal:attributes="lang current_language">
  <head>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'" />
+  <meta name="referrer" content="same-origin">
+  <meta http-equiv="Feature-Policy" content="accelerometer 'none'; ambient-light-sensor 'none'; autoplay: 'none'; battery: 'none'; camera: 'none'; display-capture: 'none'; document-domain: 'none'; encrypted-media: 'none'; geolocation: 'none'; gyroscope: 'none'; magnetometer: 'none'; microphone: 'none'; payment: 'none'; usb: 'none'" />
  <base tal:attributes="href python: '%s/' % web_section.absolute_url()" />
  <meta name="viewport" content="width=device-width,height=device-height,initial-scale=1" />
  <title tal:content="python: here.getTranslatedTitle() or web_section.getTranslatedTitle()"></title>

--- a/bt5/erp5_web_js_style/SkinTemplateItem/portal_skins/erp5_web_js_style_ui/error_main.zpt
+++ b/bt5/erp5_web_js_style/SkinTemplateItem/portal_skins/erp5_web_js_style_ui/error_main.zpt
@@ -19,6 +19,8 @@
      <tal:block metal:use-macro="global_definitions_macros/header_definitions" />
 <html tal:attributes="lang current_language">
  <head>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'none'" />
+  <meta name="referrer" content="same-origin">
  <base tal:attributes="href python: '%s/' % web_section.absolute_url()" />
  <meta name="viewport" content="width=device-width,height=device-height,initial-scale=1" />
  <title tal:content="python: web_section.getTranslatedTitle()"></title>
@@ -29,8 +31,8 @@
  <link rel="stylesheet" tal:attributes="href no_style_css_url">
  </head>
  <body>
-    <tal:block tal:content="structure python: web_section.WebSection_generateNavigationHTML()"></tal:block>
-    <main><tal:block metal:define-slot="main"/></main>
+  <tal:block tal:content="structure python: web_section.WebSection_generateNavigationHTML()"></tal:block>
+  <main><tal:block metal:define-slot="main"/></main>
  </body>
 </html>
    </tal:block>

--- a/bt5/erp5_web_js_style/SkinTemplateItem/portal_skins/erp5_web_js_style_ui/view_main.zpt
+++ b/bt5/erp5_web_js_style/SkinTemplateItem/portal_skins/erp5_web_js_style_ui/view_main.zpt
@@ -27,6 +27,9 @@
      <tal:block metal:use-macro="global_definitions_macros/header_definitions" />
 <html tal:attributes="lang current_language">
  <head>
+  <meta http-equiv="Content-Security-Policy" content="default-src 'self'" />
+  <meta name="referrer" content="same-origin">
+  <meta http-equiv="Feature-Policy" content="accelerometer 'none'; ambient-light-sensor 'none'; autoplay: 'none'; battery: 'none'; camera: 'none'; display-capture: 'none'; document-domain: 'none'; encrypted-media: 'none'; geolocation: 'none'; gyroscope: 'none'; magnetometer: 'none'; microphone: 'none'; payment: 'none'; usb: 'none'" />
  <base tal:attributes="href python: '%s/' % web_section.absolute_url()" />
  <meta name="viewport" content="width=device-width,height=device-height,initial-scale=1" />
  <title tal:content="python: here.getTranslatedTitle() or web_section.getTranslatedTitle()"></title>