mirror of https://github.com/grafana/grafana
Middleware: Add CSP support (#29740)
* Middleware: Add support for CSP Signed-off-by: Arve Knudsen <arve.knudsen@gmail.com> Co-authored by @iOrcohenpull/30213/head
Arve Knudsen
5 years ago
committed by
GitHub
parent
4ed901e1f9
commit
50b649a869
@ -0,0 +1,50 @@ |
||||
package middleware |
||||
|
||||
import ( |
||||
"crypto/rand" |
||||
"encoding/base64" |
||||
"fmt" |
||||
"io" |
||||
"net/http" |
||||
"strings" |
||||
|
||||
"github.com/grafana/grafana/pkg/infra/log" |
||||
"github.com/grafana/grafana/pkg/models" |
||||
"github.com/grafana/grafana/pkg/setting" |
||||
macaron "gopkg.in/macaron.v1" |
||||
) |
||||
|
||||
// AddCSPHeader adds the Content Security Policy header.
|
||||
func AddCSPHeader(cfg *setting.Cfg, logger log.Logger) macaron.Handler { |
||||
return func(w http.ResponseWriter, req *http.Request, c *macaron.Context) { |
||||
if !cfg.CSPEnabled { |
||||
logger.Debug("Not adding CSP header to response since it's disabled") |
||||
return |
||||
} |
||||
|
||||
logger.Debug("Adding CSP header to response", "cfg", fmt.Sprintf("%p", cfg)) |
||||
|
||||
ctx, ok := c.Data["ctx"].(*models.ReqContext) |
||||
if !ok { |
||||
panic("Failed to convert context into models.ReqContext") |
||||
} |
||||
|
||||
if cfg.CSPTemplate == "" { |
||||
logger.Debug("CSP template not configured, so returning 500") |
||||
ctx.JsonApiErr(500, "CSP template has to be configured", nil) |
||||
return |
||||
} |
||||
|
||||
var buf [16]byte |
||||
if _, err := io.ReadFull(rand.Reader, buf[:]); err != nil { |
||||
logger.Error("Failed to generate CSP nonce", "err", err) |
||||
ctx.JsonApiErr(500, "Failed to generate CSP nonce", err) |
||||
} |
||||
|
||||
nonce := base64.RawStdEncoding.EncodeToString(buf[:]) |
||||
val := strings.ReplaceAll(cfg.CSPTemplate, "$NONCE", fmt.Sprintf("'nonce-%s'", nonce)) |
||||
w.Header().Set("Content-Security-Policy", val) |
||||
ctx.RequestNonce = nonce |
||||
logger.Debug("Successfully generated CSP nonce", "nonce", nonce) |
||||
} |
||||
} |
||||
@ -1,14 +0,0 @@ |
||||
package middleware |
||||
|
||||
import ( |
||||
"github.com/grafana/grafana/pkg/models" |
||||
macaron "gopkg.in/macaron.v1" |
||||
) |
||||
|
||||
const HeaderNameNoBackendCache = "X-Grafana-NoCache" |
||||
|
||||
func HandleNoCacheHeader() macaron.Handler { |
||||
return func(ctx *models.ReqContext) { |
||||
ctx.SkipCache = ctx.Req.Header.Get(HeaderNameNoBackendCache) == "true" |
||||
} |
||||
} |
||||
@ -0,0 +1,212 @@ |
||||
package testinfra |
||||
|
||||
import ( |
||||
"fmt" |
||||
"io/ioutil" |
||||
"net" |
||||
"net/http" |
||||
"os" |
||||
"path/filepath" |
||||
"testing" |
||||
|
||||
"github.com/grafana/grafana/pkg/infra/fs" |
||||
"github.com/grafana/grafana/pkg/registry" |
||||
"github.com/grafana/grafana/pkg/server" |
||||
"github.com/grafana/grafana/pkg/services/sqlstore" |
||||
"github.com/stretchr/testify/assert" |
||||
"github.com/stretchr/testify/require" |
||||
"gopkg.in/ini.v1" |
||||
) |
||||
|
||||
// StartGrafana starts a Grafana server.
|
||||
// The server address is returned.
|
||||
func StartGrafana(t *testing.T, grafDir, cfgPath string, sqlStore *sqlstore.SQLStore) string { |
||||
t.Helper() |
||||
|
||||
origSQLStore := registry.GetService(sqlstore.ServiceName) |
||||
t.Cleanup(func() { |
||||
registry.Register(origSQLStore) |
||||
}) |
||||
registry.Register(®istry.Descriptor{ |
||||
Name: sqlstore.ServiceName, |
||||
Instance: sqlStore, |
||||
InitPriority: sqlstore.InitPriority, |
||||
}) |
||||
|
||||
t.Logf("Registered SQL store %p", sqlStore) |
||||
|
||||
listener, err := net.Listen("tcp", "127.0.0.1:0") |
||||
require.NoError(t, err) |
||||
server, err := server.New(server.Config{ |
||||
ConfigFile: cfgPath, |
||||
HomePath: grafDir, |
||||
Listener: listener, |
||||
}) |
||||
require.NoError(t, err) |
||||
|
||||
t.Cleanup(func() { |
||||
// Have to reset the route register between tests, since it doesn't get re-created
|
||||
server.HTTPServer.RouteRegister.Reset() |
||||
}) |
||||
|
||||
go func() { |
||||
// When the server runs, it will also build and initialize the service graph
|
||||
if err := server.Run(); err != nil { |
||||
t.Log("Server exited uncleanly", "error", err) |
||||
} |
||||
}() |
||||
t.Cleanup(func() { |
||||
server.Shutdown("") |
||||
}) |
||||
|
||||
// Wait for Grafana to be ready
|
||||
addr := listener.Addr().String() |
||||
resp, err := http.Get(fmt.Sprintf("http://%s/api/health", addr)) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, resp) |
||||
t.Cleanup(func() { |
||||
err := resp.Body.Close() |
||||
assert.NoError(t, err) |
||||
}) |
||||
require.Equal(t, 200, resp.StatusCode) |
||||
|
||||
t.Logf("Grafana is listening on %s", addr) |
||||
|
||||
return addr |
||||
} |
||||
|
||||
// SetUpDatabase sets up the Grafana database.
|
||||
func SetUpDatabase(t *testing.T, grafDir string) *sqlstore.SQLStore { |
||||
t.Helper() |
||||
|
||||
sqlStore := sqlstore.InitTestDB(t, sqlstore.InitTestDBOpt{ |
||||
EnsureDefaultOrgAndUser: true, |
||||
}) |
||||
// We need the main org, since it's used for anonymous access
|
||||
org, err := sqlStore.GetOrgByName(sqlstore.MainOrgName) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, org) |
||||
|
||||
// Make sure changes are synced with other goroutines
|
||||
err = sqlStore.Sync() |
||||
require.NoError(t, err) |
||||
|
||||
return sqlStore |
||||
} |
||||
|
||||
// CreateGrafDir creates the Grafana directory.
|
||||
func CreateGrafDir(t *testing.T, opts ...GrafanaOpts) (string, string) { |
||||
t.Helper() |
||||
|
||||
tmpDir, err := ioutil.TempDir("", "") |
||||
require.NoError(t, err) |
||||
t.Cleanup(func() { |
||||
err := os.RemoveAll(tmpDir) |
||||
assert.NoError(t, err) |
||||
}) |
||||
|
||||
// Search upwards in directory tree for project root
|
||||
var rootDir string |
||||
found := false |
||||
for i := 0; i < 20; i++ { |
||||
rootDir = filepath.Join(rootDir, "..") |
||||
exists, err := fs.Exists(filepath.Join(rootDir, "public", "views")) |
||||
require.NoError(t, err) |
||||
if exists { |
||||
found = true |
||||
break |
||||
} |
||||
} |
||||
require.True(t, found, "Couldn't detect project root directory") |
||||
|
||||
cfgDir := filepath.Join(tmpDir, "conf") |
||||
err = os.MkdirAll(cfgDir, 0750) |
||||
require.NoError(t, err) |
||||
dataDir := filepath.Join(tmpDir, "data") |
||||
// nolint:gosec
|
||||
err = os.MkdirAll(dataDir, 0750) |
||||
require.NoError(t, err) |
||||
logsDir := filepath.Join(tmpDir, "logs") |
||||
pluginsDir := filepath.Join(tmpDir, "plugins") |
||||
publicDir := filepath.Join(tmpDir, "public") |
||||
err = os.MkdirAll(publicDir, 0750) |
||||
require.NoError(t, err) |
||||
viewsDir := filepath.Join(publicDir, "views") |
||||
err = fs.CopyRecursive(filepath.Join(rootDir, "public", "views"), viewsDir) |
||||
require.NoError(t, err) |
||||
// Copy index template to index.html, since Grafana will try to use the latter
|
||||
err = fs.CopyFile(filepath.Join(rootDir, "public", "views", "index-template.html"), |
||||
filepath.Join(viewsDir, "index.html")) |
||||
require.NoError(t, err) |
||||
// Copy error template to error.html, since Grafana will try to use the latter
|
||||
err = fs.CopyFile(filepath.Join(rootDir, "public", "views", "error-template.html"), |
||||
filepath.Join(viewsDir, "error.html")) |
||||
require.NoError(t, err) |
||||
emailsDir := filepath.Join(publicDir, "emails") |
||||
err = fs.CopyRecursive(filepath.Join(rootDir, "public", "emails"), emailsDir) |
||||
require.NoError(t, err) |
||||
provDir := filepath.Join(cfgDir, "provisioning") |
||||
provDSDir := filepath.Join(provDir, "datasources") |
||||
err = os.MkdirAll(provDSDir, 0750) |
||||
require.NoError(t, err) |
||||
provNotifiersDir := filepath.Join(provDir, "notifiers") |
||||
err = os.MkdirAll(provNotifiersDir, 0750) |
||||
require.NoError(t, err) |
||||
provPluginsDir := filepath.Join(provDir, "plugins") |
||||
err = os.MkdirAll(provPluginsDir, 0750) |
||||
require.NoError(t, err) |
||||
provDashboardsDir := filepath.Join(provDir, "dashboards") |
||||
err = os.MkdirAll(provDashboardsDir, 0750) |
||||
require.NoError(t, err) |
||||
|
||||
cfg := ini.Empty() |
||||
dfltSect := cfg.Section("") |
||||
_, err = dfltSect.NewKey("app_mode", "development") |
||||
require.NoError(t, err) |
||||
|
||||
pathsSect, err := cfg.NewSection("paths") |
||||
require.NoError(t, err) |
||||
_, err = pathsSect.NewKey("data", dataDir) |
||||
require.NoError(t, err) |
||||
_, err = pathsSect.NewKey("logs", logsDir) |
||||
require.NoError(t, err) |
||||
_, err = pathsSect.NewKey("plugins", pluginsDir) |
||||
require.NoError(t, err) |
||||
|
||||
logSect, err := cfg.NewSection("log") |
||||
require.NoError(t, err) |
||||
_, err = logSect.NewKey("level", "debug") |
||||
require.NoError(t, err) |
||||
|
||||
serverSect, err := cfg.NewSection("server") |
||||
require.NoError(t, err) |
||||
_, err = serverSect.NewKey("port", "0") |
||||
require.NoError(t, err) |
||||
|
||||
anonSect, err := cfg.NewSection("auth.anonymous") |
||||
require.NoError(t, err) |
||||
_, err = anonSect.NewKey("enabled", "true") |
||||
require.NoError(t, err) |
||||
|
||||
for _, o := range opts { |
||||
if o.EnableCSP { |
||||
securitySect, err := cfg.NewSection("security") |
||||
require.NoError(t, err) |
||||
_, err = securitySect.NewKey("content_security_policy", "true") |
||||
require.NoError(t, err) |
||||
} |
||||
} |
||||
|
||||
cfgPath := filepath.Join(cfgDir, "test.ini") |
||||
err = cfg.SaveTo(cfgPath) |
||||
require.NoError(t, err) |
||||
|
||||
err = fs.CopyFile(filepath.Join(rootDir, "conf", "defaults.ini"), filepath.Join(cfgDir, "defaults.ini")) |
||||
require.NoError(t, err) |
||||
|
||||
return tmpDir, cfgPath |
||||
} |
||||
|
||||
type GrafanaOpts struct { |
||||
EnableCSP bool |
||||
} |
||||
@ -0,0 +1,64 @@ |
||||
package web |
||||
|
||||
import ( |
||||
"fmt" |
||||
"io" |
||||
"net/http" |
||||
"strings" |
||||
"testing" |
||||
|
||||
"github.com/grafana/grafana/pkg/tests/testinfra" |
||||
"github.com/stretchr/testify/assert" |
||||
"github.com/stretchr/testify/require" |
||||
) |
||||
|
||||
// TestIndexView tests the Grafana index view.
|
||||
func TestIndexView(t *testing.T) { |
||||
t.Run("CSP enabled", func(t *testing.T) { |
||||
grafDir, cfgPath := testinfra.CreateGrafDir(t, testinfra.GrafanaOpts{ |
||||
EnableCSP: true, |
||||
}) |
||||
sqlStore := testinfra.SetUpDatabase(t, grafDir) |
||||
addr := testinfra.StartGrafana(t, grafDir, cfgPath, sqlStore) |
||||
|
||||
// nolint:bodyclose
|
||||
resp, html := makeRequest(t, addr) |
||||
|
||||
assert.Regexp(t, "script-src 'unsafe-eval' 'strict-dynamic' 'nonce-[^']+';object-src 'none';font-src 'self';style-src 'self' 'unsafe-inline';img-src 'self' data:;base-uri 'self';connect-src 'self' grafana.com;manifest-src 'self';media-src 'none';form-action 'self';", resp.Header.Get("Content-Security-Policy")) |
||||
assert.Regexp(t, `<script nonce="[^"]+"`, html) |
||||
}) |
||||
|
||||
t.Run("CSP disabled", func(t *testing.T) { |
||||
grafDir, cfgPath := testinfra.CreateGrafDir(t) |
||||
sqlStore := testinfra.SetUpDatabase(t, grafDir) |
||||
addr := testinfra.StartGrafana(t, grafDir, cfgPath, sqlStore) |
||||
|
||||
// nolint:bodyclose
|
||||
resp, html := makeRequest(t, addr) |
||||
|
||||
assert.Empty(t, resp.Header.Get("Content-Security-Policy")) |
||||
assert.Regexp(t, `<script nonce=""`, html) |
||||
}) |
||||
} |
||||
|
||||
func makeRequest(t *testing.T, addr string) (*http.Response, string) { |
||||
t.Helper() |
||||
|
||||
u := fmt.Sprintf("http://%s", addr) |
||||
t.Logf("Making GET request to %s", u) |
||||
// nolint:gosec
|
||||
resp, err := http.Get(u) |
||||
require.NoError(t, err) |
||||
require.NotNil(t, resp) |
||||
t.Cleanup(func() { |
||||
err := resp.Body.Close() |
||||
assert.NoError(t, err) |
||||
}) |
||||
|
||||
var b strings.Builder |
||||
_, err = io.Copy(&b, resp.Body) |
||||
require.NoError(t, err) |
||||
require.Equal(t, 200, resp.StatusCode) |
||||
|
||||
return resp, b.String() |
||||
} |
||||
Loading…
Reference in new issue