Re-add CSP, use flask-talisman

ambuda/__init__.py

@@ -12,6 +12,7 @@
 from dotenv import load_dotenv
 from flask import Flask, session
 from flask_babel import Babel, pgettext
+from flask_talisman import Talisman
 from sentry_sdk.integrations.flask import FlaskIntegration
 from sqlalchemy import exc
 
@@ -93,6 +94,23 @@ def create_app(config_env: str):
 
     app = Flask(__name__)
 
+    csp = {
+        "default-src": ["'self'"],
+        "script-src": [
+            "'self'",
+            "https://cdn.jsdelivr.net",
+            "https://www.google.com",
+            "https://www.gstatic.com",
+            "https://plausible.io",
+            "'unsafe-eval'",
+        ],
+        "frame-src": ["https://www.google.com"],
+        "img-src": ["'self'", "data:"],
+        "style-src": ["'self'", "'unsafe-inline'"],
+    }
+
+    Talisman(app, content_security_policy=csp, force_https=config_env != config.TESTING)
+
     # Config
     app.config.from_object(config_spec)
 

ambuda/static/js/proofer.js

@@ -64,6 +64,8 @@ export default () => ({
     this.loadSettings();
     this.layoutClasses = this.getLayoutClasses();
 
+    const IMAGE_URL = JSON.parse(document.getElementById('image_url').innerText);
+
     // Set `imageZoom` only after the viewer is fully initialized.
     this.imageViewer = initializeImageViewer(IMAGE_URL);
     this.imageViewer.addHandler('open', () => {

ambuda/templates/header-main-footer.html

@@ -7,7 +7,7 @@
     <script defer src="https://cdn.jsdelivr.net/npm/@indic-transliteration/[email protected]/sanscript.min.js"></script>
     {# Load scripts before Alpine so that our init hooks are properly set up. #}
     <script defer src="{{ asset('gen/main.js') }}"></script>
-    <script src="https://unpkg.com/[email protected]/dist/cdn.min.js" defer></script>
+    <script src="https://cdn.jsdelivr.net/npm/[email protected]/dist/cdn.min.js" defer></script>
 {% endblock %}
 
 

ambuda/templates/proofing/create-project-post.html

@@ -23,7 +23,4 @@ <h1>Create new project</h1>
 </div>
 </div>
 
-<script type="text/javascript">
-</script>
-
 {% endblock %}

ambuda/templates/proofing/pages/edit.html

@@ -82,7 +82,5 @@
 
 <script src="https://cdn.jsdelivr.net/npm/[email protected]/build/openseadragon/openseadragon.min.js"></script>
 {% set image_url = url_for("site.page_image", project_slug=project.slug, page_slug=cur.slug) %}
-<script type="text/javascript">
-const IMAGE_URL = "{{ image_url }}";
-</script>
+<script type="application/json" id="image_url">"{{ image_url }}"</script>
 {% endblock %}

requirements.txt

@@ -35,6 +35,7 @@ Flask-Babel==2.0.0
 Flask-Bcrypt==1.0.1
 Flask-Login==0.6.1
 Flask-Mail==0.9.1
+flask-talisman==1.0.0
 Flask-WTF==1.0.1
 fonttools==4.33.3
 gevent==21.12.0

test/js/proofer.test.js

@@ -5,12 +5,12 @@ const sampleHTML = `
 <div>
   <textarea id="content"></textarea>
 </div>
+<script type="application/json" id="image_url">IMAGE_URL</script>
 `;
 
 // Can't modify existing `window.location` -- delete it so that we can mock it.
 // (See beforeEach and the tests below.)
 delete window.location;
-window.IMAGE_URL = 'IMAGE_URL';
 window.OpenSeadragon = (_) => ({
   addHandler: jest.fn((_, callback) => callback()),
   viewport: {