Re-add CSP, use flask-talisman

ambuda/__init__.py

@@ -11,6 +11,7 @@
 import sentry_sdk
 from dotenv import load_dotenv
 from flask import Flask
+from flask_talisman import Talisman
 from sentry_sdk.integrations.flask import FlaskIntegration
 from sqlalchemy import exc
 
@@ -88,6 +89,26 @@ def create_app(config_env: str):
 
     app = Flask(__name__)
 
+    csp = {
+        "default-src": ["'self'"],
+        "script-src": [
+            "'self'",
+            "https://cdn.jsdelivr.net",
+            "https://www.google.com",
+            "https://www.gstatic.com",
+            "https://plausible.io",
+            "'unsafe-eval'",
+        ],
+        "frame-src": ["https://www.google.com"],
+        "img-src": ["'self'", "data:"],
+        "style-src": ["'self'", "'unsafe-inline'"],
+    }
+
+    Talisman(
+        app,
+        content_security_policy=csp,
+    )
+
     # Config
     app.config.from_object(config_spec)
 

ambuda/static/js/proofer.js

@@ -1,4 +1,4 @@
-/* global Alpine, $, OpenSeadragon, IMAGE_URL */
+/* global Alpine, $, OpenSeadragon */
 /* Transcription and proofreading interface. */
 
 import { $ } from './core.ts';
@@ -60,6 +60,8 @@ export default () => ({
     this.loadSettings();
     this.layoutClasses = this.getLayoutClasses();
 
+    const IMAGE_URL = JSON.parse(document.getElementById('image_url').innerText);
+
     // Set `imageZoom` only after the viewer is fully initialized.
     this.imageViewer = initializeImageViewer(IMAGE_URL);
     this.imageViewer.addHandler('open', () => {

ambuda/templates/proofing/pages/edit.html

@@ -166,7 +166,5 @@ <h1 class="text">
 
 <script src="https://cdn.jsdelivr.net/npm/openseadragon@3.1/build/openseadragon/openseadragon.min.js"></script>
 {% set image_url = url_for("site.page_image", project_slug=project.slug, page_slug=cur.slug) %}
-<script type="text/javascript">
-const IMAGE_URL = "{{ image_url }}";
-</script>
+<script type="application/json" id="image_url">"{{ image_url }}"</script>
 {% endblock %}

requirements.txt

@@ -33,6 +33,7 @@ Flask-Admin==1.6.0
 Flask-Bcrypt==1.0.1
 Flask-Login==0.6.1
 Flask-Mail==0.9.1
+flask-talisman==1.0.0
 Flask-WTF==1.0.1
 fonttools==4.33.3
 gevent==21.12.0