T3DD23 Content Security Policy - Concept, Strategies & Pitfalls

Content-Security-Policy
Concept, Strategies, Pitfalls
Oliver Hader
oliver@typo3.org
@ohader
TYPO3 Developer Days 2023
August 4th, 2023

TYPO3 Developer Days 2023 - Content-Security-Policy - oliver.hader@typo3.org 2
▪Research & Development
▪TYPO3 Security Team Lead
▪50% TYPO3 GmbH / 50% Freelancer
▪#hof #cycling #paramedic #in.die.musik
~# whoami
Oliver Hader
@ohader

▪ Why?
▪ Concept
Introduction to Content-Security-Policy
▪ Pitfalls
Examples and CSP in Action
▪ Strategies
Content-Security-Policy in TYPO3 v12+
Agenda

TYPO3 Developer Days 2023 - Content-Security-Policy - oliver.hader@typo3.org
Why?
cause matters
4

▪ please, don’t publish security
vulnerabilities to public channels
▪ not on GitHub/Forge
▪ not in Slack channels
▪ not on Twitter, ...
▪ report to security@typo3.org
▪ security team supports community
Trigger Warning
⚠︎

Why?
6
▪ cross-site scripting & privacy concerns
▪ 2018-2023: 34 XSS vulnerabilities in TYPO3 CMS
▪ script execution / remote control via JavaScript
(in the scope & with the permissions of the victim)
▪ trigger download of executable applications
▪ extract users’ details (location, IP address, session data, …)
▪ <script> | <img src=“~” onerror=“…”> | <iframe> | <style> | …

Video <script>

Video <link rel=“stylesheet”>

Concept
Content-Security-
Policy
9

Content-Security-Policy as meta tag or HTTP header (preferred)
Content-Security-Policy (CSP)

11
▪ default-src
▪ img-src
▪ child-src
▪ frame-src
▪ script-src | style-src
▪ sandbox
▪ *-src
▪ ’none’
▪ ’self’
▪ *.example.org
▪ https://example.org
▪ https: | data:
▪ [script|style]-src
▪ ’unsafe-eval’
▪ ’unsafe-inline’
▪ ’nonce-…’
▪ ’strict-dynamic’
directive source source

docs https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP

script-src (CSP2) vs. script-src, script-src-elem, script-src-attr (CSP3)
Content-Security-Policy (CSP) - Examples
example.org
‘unsafe-inline’
script-src-elem
… ‘unsafe-eval’
‘unsafe-inline’
‘unsafe-hashes’
script-src-elem
script-src-attr
script-src-elem
1
2
3
4

style-src (CSP2) vs. style-src, style-src-elem, style-src-attr (CSP3)
Content-Security-Policy (CSP) - Examples
style-src-elem
style-src-elem style-src-attr
example.org
‘unsafe-inline’
‘unsafe-inline’
1
2 3

Support of CSP Level 3 script-src-elem - Apple: “nope”

button clicked, script execution blocked
Content-Security-Policy (CSP) - onclick example

button clicked, ‘unsafe-inline’ script executed

button clicked, ‘unsafe-hashes’ script executed

HTML on typo3v12, loads from hacko3v12, loads from other3v12
Content-Security-Policy (CSP) - external scripts example
on https://typo3v12.ddev.site/…
https://hacko3v12.ddev.site/static/cross-script.js

loaded from typo3v12, hacko3v12, other3v12, blocked eval

allow loading all scripts via ‘strict-dynamic’ when nonce is given

‘strict-dynamic’ works when using DOM-API ✅ - denied for “parser-inserted” script ❌
on https://typo3v12.ddev.site/…
https://hacko3v12.ddev.site/static/cross-script.js
✅
❌
✅

Support of CSP Level 3 strict-dynamic - Apple: “yepp”

Content-Security-Policy (CSP) - CSP Simulator
▪ github.com/ohader/csp-simulator
▪ Content-Security-Policy Simulator
▪ HTTP man-in-the-middle proxy
▪ for arbitrary websites
24

Strategies
The TYPO3 POV
25

TYPO3 and CSP
26
▪ general: prevention & detection strategy
▪ provide tools/APIs, suggestions, advisories
▪ Content-Security-Policy to mitigate XSS vulnerabilities
▪ with TYPO3 v12: available, but not enforced
▪ with TYPO3 v13: plans, to enable CSP per default
▪ listen & incorporate community feedback & experience

Dedicated feature flag scopes (backend, frontend, frontend & site)
TYPO3 and CSP

Excerpt of CSP “Policy” models, directives, sources, …
TYPO3 and CSP

Static CSP declaration for extensions in PHP or site config
TYPO3 and CSP

TYPO3 and CSP
▪ “nonce” = number used once(!)
(must be random, not predictable)
▪ nonce value added automatically
for static(!) files in PageRender
▪ nonce value added for inline
scripts and styles when explicitly
requested, in PageRenderer and
AssetCollector
▪ (incl. Fluid view helpers)
30

CSP reporting backend module
TYPO3 and CSP

CSP reporting backend module & applying “resolutions”
TYPO3 and CSP

Individual CSP violation handlers, suggesting “resolutions”
TYPO3 and CSP

CSP HTTP header for backend requests
TYPO3 and CSP

Manually triggered CSP violation (eval)
TYPO3 and CSP

CSP violation sent back to TYPO3 reporting endpoint
TYPO3 and CSP

CSP violation sent back to TYPO3 reporting endpoint

Pitfalls
observations
38

Pitfalls
▪ […] ’unsafe-inline’ is
ignored if either a hash or
nonce value is present […]
▪ same for style-src
▪ (TYPO3 is prepared to add
nonce values everywhere*)
39

Google’s Suggestion on Integrating Google Maps
Pitfalls
❌ CSP Level 3
CSP Level 2

Pitfalls
▪ false-positive reports
▪ caused by browser plugins
▪ can use own scheme, e.g.
▪ moz-extension:
▪ safari-extension:
41

Pitfalls
▪ moz-extension:
42

Pitfalls
▪ moz-extension:
43

Pitfalls
▪ Google Translate proxies site
▪ request was actually blocked
44

Pitfalls
▪ something™ changes base-uri
▪ <base href=“https://h4ck3r.org”>
▪ CSP: base-uri ‘none’ | ‘self’
45

Conclusion?
46

Conclusion?
47
▪ unfinished CSP Level 3 (draft) vs CSP Level 2 (2016)
▪ painful backward compatibility & open questions
▪ somewhere in between max. convenience & max. security
▪ please enable CSP in TYPO3 v12 (backend, maybe frontend)
▪ report your findings & feedback to https://forge.typo3.org

T3DD23 Content Security Policy - Concept, Strategies & Pitfalls

Recommended

Recommended

More Related Content

What's hot

What's hot (7)

Similar to T3DD23 Content Security Policy - Concept, Strategies & Pitfalls

Similar to T3DD23 Content Security Policy - Concept, Strategies & Pitfalls (20)

More from Oliver Hader

More from Oliver Hader (15)

Recently uploaded

Recently uploaded (20)

T3DD23 Content Security Policy - Concept, Strategies & Pitfalls