Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Preprocess HTML: wrap Content-Security-Policy meta tag into comment #8075

Closed
wants to merge 1 commit into from
Closed

Preprocess HTML: wrap Content-Security-Policy meta tag into comment #8075

wants to merge 1 commit into from

Conversation

vitaliy-guliy
Copy link
Contributor

@vitaliy-guliy vitaliy-guliy commented Jun 23, 2020 •
edited
Loading

What it does

Wraps into comment (disables) Content-Security-Policy meta tag in HEAD section in webview HTML.
It needs for Jira and Bitbucket extension, which use webviews to display some pages.

The extension opens a webview with initial HTML:

<!DOCTYPE html>
<html lang="en">
    <head>
        <meta charset="utf-8" />
        <base href="vscode-resource:/tmp/vscode-unpacked/atlascode-0.0.0.vsix/extension/" />
        <!-- <meta name="viewport" content="width=device-width,initial-scale=0,shrink-to-fit=no" /> -->
        <meta name="theme-color" content="#000000" />
        <meta id="reactView" name="reactView" content="atlascodeSettingsV2" />
        <title>Atlassian Webview</title>
        <meta
            http-equiv="Content-Security-Policy"
            content="
                default-src https://api.atlassian.com ; 
                img-src data: vscode-resource: http: https: blob:; 
                object-src data:; 
                script-src vscode-resource:;
                style-src vscode-resource: 'unsafe-inline' blob: http: https: data:;"
        />
    </head>

    <body>
        <noscript>You need to enable JavaScript to run this app.</noscript>

        <div id="root"></div>
        <script src="vscode-resource:/tmp/vscode-unpacked/atlascode-0.0.0.vsix/extension/build/static/js/mui.454e318f.js"></script>
    </body>
</html>

Java script src refers on the resource using vscode-resource: scheme in the URI. To have such resource being loaded, Theia pre-processes the URI before inserting the HTML.
But if the webview has restrictions (script-src vscode-resource:) provided by Content-Security-Policy meta tag, the browser blocks all the requests to that resources.

Screenshot from 2020-06-03 12-51-25

The idea is to temporary wrapping into comment such meta tags while we don't have any solution how to handle resources with vscode-resource: and theia-resource: schemes.

Original issue describing the problem eclipse-che/che#17081

How to test

In any webview

  • use an image or script with vscode-resource: or theia-resource: scheme in the URI
  • add the following meta tag to the head
        <meta
            http-equiv="Content-Security-Policy"
            content="
                default-src https://api.atlassian.com ; 
                img-src vscode-resource: theia-resource:;  
                script-src vscode-resource: theia-resource:;
                style-src vscode-resource: theia-resource:;"
        />

Review checklist

@vitaliy-guliy vitaliy-guliy force-pushed the change-content-security-policy branch from 88af814 to 5dfae96 Compare June 23, 2020 10:44
@vitaliy-guliy vitaliy-guliy changed the title Preprocess HTML: wrap Content-Security-Policy meta tag into comment [WIP] Preprocess HTML: wrap Content-Security-Policy meta tag into comment Jun 23, 2020
@vitaliy-guliy
Wrap into comment Content-Security-Policy meta tag
346ea88 
Signed-off-by: Vitaliy Gulyy <vgulyy@redhat.com>
@vitaliy-guliy vitaliy-guliy force-pushed the change-content-security-policy branch from 50402f5 to 346ea88 Compare June 23, 2020 10:51
@vitaliy-guliy vitaliy-guliy changed the title [WIP] Preprocess HTML: wrap Content-Security-Policy meta tag into comment Preprocess HTML: wrap Content-Security-Policy meta tag into comment Jun 23, 2020
@vitaliy-guliy vitaliy-guliy mentioned this pull request Jun 23, 2020
Closed
1 task
@akosyakov
Copy link
Member

akosyakov commented Jun 23, 2020 •
edited
Loading

Preprocessor takes care of vscode-resource as well. CSP there to ensure security it cannot be worked around. Generally vscode-resource is deprecated, it does not seem that this extension was adjusted to work in remote context. It should use webviews.asWebviewUri function. For instance see how another extension is adjusted: mhutchie/vscode-git-graph#305 Please file a bug request against the extension.

@akosyakov akosyakov added security issues related to security webviews issues related to webviews labels Jun 23, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@svenefftinge svenefftinge Awaiting requested review from svenefftinge

@benoitf benoitf Awaiting requested review from benoitf

@AlexTugarev AlexTugarev Awaiting requested review from AlexTugarev

@akosyakov akosyakov Awaiting requested review from akosyakov

@vinokurig vinokurig Awaiting requested review from vinokurig

@vince-fugnitto vince-fugnitto Awaiting requested review from vince-fugnitto

Assignees
No one assigned
Labels
security issues related to security webviews issues related to webviews
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@vitaliy-guliy @akosyakov