Move from report-only to real CSP after testing

Author: pimterry

Caddyfile

@@ -19,5 +19,6 @@
     header Referrer-Policy "strict-origin"
     header X-Clacks-Overhead "GNU Terry Pratchett" # https://xclacksoverhead.org
 
-    import /site/csp.caddyfile # Generated by webpack
+    import /site/csp-report.caddyfile # Generated by webpack
+    import /site/csp-strict.caddyfile # Generated by webpack
 }

automation/webpack.prod.ts

@@ -25,6 +25,23 @@ console.log(CSP_REPORT_URL
     : `CSP reporting skipped (uri: ${process.env.REPORT_URI}. version: ${process.env.UI_VERSION})`
 );
 
+
+// Output compiled CSP into a Caddy config file, that's later imported by our Caddyfile:
+const processCsp = (type: 'report' | 'strict') => (
+    builtPolicy: any,
+    _htmlPluginData: any,
+    _obj: any,
+    compilation: any
+) => {
+    const header = `
+        header ${
+            type === 'strict' ? 'Content-Security-Policy' : 'Content-Security-Policy-Report-Only'
+        } "${builtPolicy}"
+        header Reporting-Endpoints \`csp-endpoint="${CSP_REPORT_URL}"\`
+    `;
+    compilation.emitAsset(`csp-${type}.caddyfile`, new RawSource(header));
+}
+
 export default merge(common, {
     mode: "production",
 
@@ -129,6 +146,8 @@ export default merge(common, {
         }),
         ...(CSP_REPORT_URL
             ? [
+
+                // Report-only CSP, covering roughly where we're aiming to be right now:
                 new CspHtmlWebpackPlugin({
                     'base-uri': "'self'",
                     'default-src': "'none'",
@@ -143,6 +162,7 @@ export default merge(common, {
                     'script-src': [
                         "'report-sample'",
                         "'unsafe-eval'", // For both wasm & real eval() uses
+                        "'wasm-unsafe-eval'",
                         "'self'",
                         'https://cdn.auth0.com', 'https://cdn.eu.auth0.com', 'https://secure.gravatar.com'
                     ],
@@ -164,18 +184,39 @@ export default merge(common, {
                         'style-src': false
                     },
                     // Output CSP into a Caddy config file, that's imported by Caddyfile
-                    processFn: (
-                        builtPolicy: any,
-                        _htmlPluginData: any,
-                        _obj: any,
-                        compilation: any
-                    ) => {
-                        const header = `
-                            header Content-Security-Policy-Report-Only "${builtPolicy}"
-                            header Reporting-Endpoints \`csp-endpoint="${CSP_REPORT_URL}"\`
-                        `;
-                        compilation.emitAsset('csp.caddyfile', new RawSource(header));
-                    }
+                    processFn: processCsp('report')
+                } as any),
+                // Actually strict CSP, covering what I'm pretty sure tested & known to be
+                // safe right now:
+                new CspHtmlWebpackPlugin({
+                    'base-uri': "'self'",
+                    'default-src': "*",
+                    'object-src': "'none'",
+                    'frame-ancestors': "'none'",
+                    'img-src': "*",
+                    'font-src': "*",
+                    'style-src': ["'report-sample'", "*", "'unsafe-inline'"],
+                    'frame-src': "https://login.httptoolkit.tech",
+                    'script-src': [
+                        "'report-sample'",
+                        "'unsafe-eval'", // For both wasm & real eval() uses
+                        "'wasm-unsafe-eval'",
+                        "'self'",
+                        "*"
+                    ],
+                    'report-uri': CSP_REPORT_URL,
+                    'report-to': 'csp-endpoint'
+                }, {
+                    enabled: true,
+                    hashEnabled: {
+                        'script-src': true,
+                        'style-src': false
+                    },
+                    nonceEnabled: {
+                        'script-src': false,
+                        'style-src': false
+                    },
+                    processFn: processCsp('strict')
                 } as any)
             ]
         : [])