From 601687872a496d2e8f0f17474bd399b98c39a8cc Mon Sep 17 00:00:00 2001
From: jzhao234 <junzhao234@gmail.com>
Date: Mon, 14 Sep 2026 20:25:31 +0000
Subject: [PATCH] fix(auth): add a Content-Security-Policy to every Explorer
 page

TL;DR: Explorer pages now ship a Content-Security-Policy that lets only this origin's scripts plus the page's own nonced inline blocks run, allows styles only from this origin, and permits remote images because email bodies reference them. An injected script or event handler cannot execute even if some markup slips through.

Problem:
Explorer set X-Content-Type-Options, X-Frame-Options and Referrer-Policy but no CSP. It renders sanitized email bodies inline and holds a session cookie, which is exactly the page you want a script policy on. Auth got a nonce-based CSP in its first release; the applications did not.

Fix:
- security_headers middleware generates a per-response nonce, sets a page policy on text/html responses and a closed default-src 'none' policy on everything else.
- Page policy: default-src 'self'; script-src 'self' plus the nonce; style-src 'self'; img-src 'self' data: https:; font-src and connect-src 'self'; object-src 'none'; base-uri 'none'; frame-ancestors 'none'.
- The four inline <script> blocks (theme bootstrap and loading bar in base.html, inbox behaviour, detail behaviour) carry the nonce. The flatpickr vendor script loads from /static and needs none.
- style-src is strict because the templates have no inline styles and the email sanitizer strips style attributes and <style> blocks; img-src allows https: and data: because sanitized email bodies keep <img src> over https, data and cid (cid never resolves).
- No form-action: Elcano-mode logout is a form POST that redirects to the auth host, and browsers apply form-action to that redirect.

Tests:
- New: the inbox page's CSP names a nonce matching its inline scripts, the page has no bare <script>, inline handlers or style attributes, the nonce differs per response, and /health gets the closed policy.
- Ran: pytest -q (full suite), ruff check, ruff format --check.
---
 app/main.py                          | 30 ++++++++++++++++++++++++++++
 app/templates/base.html              |  4 ++--
 app/templates/email_detail.html      |  2 +-
 app/templates/inbox.html             |  2 +-
 tests/test_central_auth_endpoints.py | 30 ++++++++++++++++++++++++++++
 5 files changed, 64 insertions(+), 4 deletions(-)

diff --git a/app/main.py b/app/main.py
index 6405061..08b31c4 100644
--- a/app/main.py
+++ b/app/main.py
@@ -4,6 +4,7 @@
 from __future__ import annotations
 
 import os
+import secrets
 import threading
 import time
 from collections.abc import AsyncIterator
@@ -147,11 +148,40 @@ def is_allowed_s3_key(key: str) -> bool:
     return key.startswith(ALLOWED_S3_KEY_ROOTS)
 
 
+# Content-Security-Policy. Pages carry a handful of inline <script> blocks
+# (theme bootstrap, loading bar, inbox and detail behaviour); each gets this
+# response's nonce, and everything else loads from this origin. Scripts are
+# the strict part: no inline handlers, no eval, no other origins, so injected
+# markup cannot run script. Styles are 'self' only: the templates have no
+# inline styles, and the sanitizer in s3_email.py strips style attributes and
+# <style> blocks from email bodies before they are rendered. Email bodies may
+# reference remote images, so img-src allows https: and data: (cid: images
+# never resolve and are harmless). No form-action: Elcano-mode logout is a
+# form POST that redirects to the auth host, and browsers apply form-action
+# to that redirect. frame-ancestors 'none' mirrors X-Frame-Options: DENY.
+CSP_NON_PAGE = "default-src 'none'; base-uri 'none'; frame-ancestors 'none'"
+
+
+def csp_for_page(nonce: str) -> str:
+    return (
+        f"default-src 'self'; script-src 'self' 'nonce-{nonce}'; style-src 'self'; "
+        "img-src 'self' data: https:; font-src 'self'; connect-src 'self'; "
+        "object-src 'none'; base-uri 'none'; frame-ancestors 'none'"
+    )
+
+
 @app.middleware("http")
 async def security_headers(request: Request, call_next) -> Response:
     # Caddy sets these too; keeping them here covers the legacy nginx path
     # and direct loopback access.
+    request.state.csp_nonce = secrets.token_urlsafe(16)
     response = await call_next(request)
+    if response.headers.get("content-type", "").startswith("text/html"):
+        response.headers["Content-Security-Policy"] = csp_for_page(
+            request.state.csp_nonce
+        )
+    else:
+        response.headers.setdefault("Content-Security-Policy", CSP_NON_PAGE)
     response.headers.setdefault("X-Content-Type-Options", "nosniff")
     response.headers.setdefault("X-Frame-Options", "DENY")
     response.headers.setdefault("Referrer-Policy", "strict-origin-when-cross-origin")
diff --git a/app/templates/base.html b/app/templates/base.html
index f3c7556..288c501 100644
--- a/app/templates/base.html
+++ b/app/templates/base.html
@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>{{ title or "Explorer" }}</title>
-    <script>
+    <script nonce="{{ request.state.csp_nonce }}">
       (function () {
         const storageKey = "flag-theme-preference";
         let preference = null;
@@ -58,7 +58,7 @@ <h1 class="ds-app-header__title">{% block header_title %}Explorer{% endblock %}<
       {% endblock %}
       <main class="page">{% block content %}{% endblock %}</main>
     </div>
-    <script>
+    <script nonce="{{ request.state.csp_nonce }}">
       (function () {
         const root = document.documentElement;
         const toggle = document.getElementById("toggleTheme");
diff --git a/app/templates/email_detail.html b/app/templates/email_detail.html
index 4654db0..49eefbe 100644
--- a/app/templates/email_detail.html
+++ b/app/templates/email_detail.html
@@ -86,7 +86,7 @@ <h1 class="message-thread__subject">{{ email.subject or "(no subject)" }}</h1>
   </article>
 </section>
 
-<script>
+<script nonce="{{ request.state.csp_nonce }}">
   (function () {
     const formatDates = () => {
       const formatter = new Intl.DateTimeFormat(undefined, {
diff --git a/app/templates/inbox.html b/app/templates/inbox.html
index 29c3127..9648c72 100644
--- a/app/templates/inbox.html
+++ b/app/templates/inbox.html
@@ -319,7 +319,7 @@ <h3 class="empty-state__title">No emails matched this search</h3>
 {% endif %}
 
 <script src="/static/vendor/flatpickr/flatpickr.min.js"></script>
-<script>
+<script nonce="{{ request.state.csp_nonce }}">
   (function () {
     const form = document.getElementById("search-form");
     const submitButton = document.getElementById("search-submit");
diff --git a/tests/test_central_auth_endpoints.py b/tests/test_central_auth_endpoints.py
index 7be2e7c..0112726 100644
--- a/tests/test_central_auth_endpoints.py
+++ b/tests/test_central_auth_endpoints.py
@@ -365,3 +365,33 @@ def test_central_mode_refuses_to_start_without_the_auth_public_key(
     monkeypatch.setenv("AUTH_SIGNING_PUBKEY", "not-32-bytes")
     with pytest.raises(RuntimeError, match="AUTH_SIGNING_PUBKEY"):
         CentralAuthProvider.from_env(FakeAuthClient)
+
+
+def test_pages_carry_nonce_csp_and_other_responses_a_closed_one(central_client) -> None:
+    import re
+
+    client, _store = central_client
+    complete_login(client)
+
+    page = client.get("/", follow_redirects=False)
+    assert page.status_code == 200
+    csp = page.headers["content-security-policy"]
+    match = re.search(r"script-src 'self' 'nonce-([A-Za-z0-9_-]+)'", csp)
+    assert match, csp
+    nonce = match.group(1)
+    assert "default-src 'self'" in csp
+    assert "style-src 'self';" in csp
+    assert "img-src 'self' data: https:" in csp
+    assert "frame-ancestors 'none'" in csp
+    assert "form-action" not in csp
+    body = page.text
+    assert "<script>" not in body
+    assert body.count(f'<script nonce="{nonce}">') >= 1
+    assert not re.search(r' on[a-z]+="', body)
+    assert ' style="' not in body
+
+    second = client.get("/", follow_redirects=False)
+    assert second.headers["content-security-policy"] != csp
+
+    health = client.get("/health")
+    assert health.headers["content-security-policy"] == main.CSP_NON_PAGE