Add Content Security Policy headers to all jQuery content sites

[timmywil]

Proposed header value

"default-src 'self'; script-src 'self' code.jquery.com; connect-src 'self'; img-src 'self'; style-src 'self';"

This should be tested with a report header first

• Set up an endpoint that can accept security reports

[timmywil]

This also depends on jquery/jquery-wp-content#463

Also, the nginx changes are only being deployed to staging atm.

[Krinkle]

@timmywil Of the three changed roles, only grunt has staging. It seems https://stage.gruntjs.com/ is now down. I guess an nginx syntax error?

[timmywil]

After consulting the docs, I don't see anything obviously wrong with the syntax. Instead, I think the issue has to do with the grunt site's use of proxy_pass. The way to address that seems to have changed over the years, but I think moving add_header to the location block will work. Also, we can add always to the end to ensure the header is sent along even in error responses.

[Krinkle]

@timmywil That didn't seem to bring the site back. I tried logging into the droplet, to check its puppet log and nginx error, but it's not responding to SSH.

Looks like something on 22 Aug (two days before your first patch). Could it be a coincidence?

[Krinkle]

I've rebooted the instance and the site is now back up. Investigation at #60 (unrelated to this).

[Krinkle]

@timmywil It seems even after #61, Firefox still reports the following console warning:

Content-Security-Policy: This site (https://stage.gruntjs.com/) has a Report-Only policy without a report-uri directive nor a report-to directive. CSP will not block and cannot report violations of this policy.

Looking the HTTP response:

content-security-policy-report-only: default-src 'self'; script-src 'self' code.jquery.com; connect-src 'self'; img-src 'self'; style-src 'self'; report-to https://csp-report-api.openjs-foundation.workers.dev/

This doesn't contain the relevant change.

Looking at the server:

gruntjs-03: sudo journalctl -u puppet
Sep 11 15:41:36 gruntjs-03 puppet-agent[84450]: (/Stage[main]/Profile::Gruntjscom/Nginx::Site[gruntjscom]/File[/etc/nginx/sites-available/gruntjscom]/content) content changed '{sha256}652386e2d2d1f1c33>
Sep 11 15:41:36 gruntjs-03 puppet-agent[84450]: (/Stage[main]/Nginx/Exec[nginx-reload]/returns) Job for nginx.service failed.
Sep 11 15:41:36 gruntjs-03 puppet-agent[84450]: (/Stage[main]/Nginx/Exec[nginx-reload]/returns) See "systemctl status nginx.service" and "journalctl -xeu nginx.service" for details.
Sep 11 15:41:36 gruntjs-03 puppet-agent[84450]: (/Stage[main]/Nginx/Exec[nginx-reload]) Failed to call refresh: '/usr/sbin/service nginx reload' returned 1 instead of one of [0]

gruntjs-03$ systemctl status nginx.service
Sep 11 15:41:36 gruntjs-03 nginx[84606]: 2024/09/11 15:41:36 [emerg] 84606#84606: invalid number of arguments in "add_header" directive in /etc/nginx/sites-enabled/gruntjscom:24

So it has protected itself by keeping the server running with the previous configuration for now.

[timmywil]

Sorry about that. I'll look into it.

[timmywil]

I think it's just a missing semicolon

[timmywil]

I just noticed I missed an unsafe-inline for scripts on mobile themeroller (I had done styles, which took care of 95% of the errors). I'll do a PR for that soon.

Edit: PR merged at #68

[timmywil]

Some remaining items found in logs:

PR	Rule	Value	Notes	URL
gruntjs/gruntjs.com#243	script-src	http://gruntjs.disqus.com	Remove disqus instead of adding exceptions	https://gruntjs.com/blog/2013-11-21-grunt-0.4.2-released
#69	style-src	unsafe-inline	several pages have some inline styles	https://demos.jquerymobile.com/1.5.0-rc1/navbar/
#69	script-src	unsafe-inline	inline script for a popup	https://demos.jquerymobile.com/1.4.5/popup/
#69	script-src	code.jquery.com	loads jquery 1.7.1	https://demos.jquerymobile.com/1.2.0/docs/api/events.html
#69	style-src and img-src	code.jquery.com	styles and images loaded	https://demos.jquerymobile.com/1.0.1/