Skip to content

Commit eff5e2d

Browse files
jhadvigjhadvig
committed
CONSOLE-4265: Add new API field to ConsolePlugin CRD for allowing additional CSP sources
1 parent 8a37acc commit eff5e2d

21 files changed

+2377
-8
lines changed

‎console/v1/tests/consoleplugins.console.openshift.io/ConsolePluginContentSecurityPolicy.yaml‎

Lines changed: 193 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,193 @@
1+
apiVersion: apiextensions.k8s.io/v1 # Hack because controller-gen complains if we don't have this
2+
name: "ConsolePlugin"
3+
crdName: consoleplugins.console.openshift.io
4+
featureGate: ConsolePluginContentSecurityPolicy
5+
version: v1
6+
tests:
7+
onCreate:
8+
- name: Should be able to create a ConsolePlugin with valid CSP configuration
9+
initial: |
10+
apiVersion: console.openshift.io/v1
11+
kind: ConsolePlugin
12+
spec:
13+
displayName: foo
14+
backend:
15+
type: Service
16+
contentSecurityPolicy:
17+
- directive: ScriptSrc
18+
values:
19+
- https://script1.com/
20+
- directive: ImgSrc
21+
values:
22+
- https://img1.com/
23+
expected: |
24+
apiVersion: console.openshift.io/v1
25+
kind: ConsolePlugin
26+
spec:
27+
displayName: foo
28+
backend:
29+
type: Service
30+
contentSecurityPolicy:
31+
- directive: ScriptSrc
32+
values:
33+
- https://script1.com/
34+
- directive: ImgSrc
35+
values:
36+
- https://img1.com/
37+
- name: Should throw an error for duplicate CSP directive entries
38+
initial: |
39+
apiVersion: console.openshift.io/v1
40+
kind: ConsolePlugin
41+
spec:
42+
displayName: foo
43+
backend:
44+
type: Service
45+
contentSecurityPolicy:
46+
- directive: ScriptSrc
47+
values:
48+
- https://script1.com/
49+
- directive: ScriptSrc
50+
values:
51+
- https://script1.com/
52+
expectedError: "spec.contentSecurityPolicy[1]: Duplicate value: map[string]interface {}{\"directive\":\"ScriptSrc\"}"
53+
- name: Should throw an error for duplicate CSP directive values
54+
initial: |
55+
apiVersion: console.openshift.io/v1
56+
kind: ConsolePlugin
57+
spec:
58+
displayName: foo
59+
backend:
60+
type: Service
61+
contentSecurityPolicy:
62+
- directive: ScriptSrc
63+
values:
64+
- https://script1.com/
65+
- https://script1.com/
66+
expectedError: "spec.contentSecurityPolicy[0].values: Invalid value: \"array\": each CSP directive value must be unique"
67+
- name: Should throw an error for incorrect directive type
68+
initial: |
69+
apiVersion: console.openshift.io/v1
70+
kind: ConsolePlugin
71+
spec:
72+
displayName: foo
73+
backend:
74+
type: Service
75+
contentSecurityPolicy:
76+
- directive: TestSrc
77+
values:
78+
- https://script1.com/
79+
expectedError: "spec.contentSecurityPolicy[0].directive: Unsupported value: \"TestSrc\": supported values: \"DefaultSrc\", \"ScriptSrc\", \"StyleSrc\", \"ImgSrc\", \"FontSrc\""
80+
- name: Should throw an error for invalid CSP directive values, using wildcard
81+
initial: |
82+
apiVersion: console.openshift.io/v1
83+
kind: ConsolePlugin
84+
spec:
85+
displayName: foo
86+
backend:
87+
type: Service
88+
contentSecurityPolicy:
89+
- directive: ScriptSrc
90+
values:
91+
- "*"
92+
expectedError: "spec.contentSecurityPolicy[0].values[0]: Invalid value: \"string\": CSP directive value cannot be a wildcard"
93+
- name: Should be able to create a ConsolePlugin with valid CSP value, using domain with wildcard prefix
94+
initial: |
95+
apiVersion: console.openshift.io/v1
96+
kind: ConsolePlugin
97+
spec:
98+
displayName: foo
99+
backend:
100+
type: Service
101+
contentSecurityPolicy:
102+
- directive: ScriptSrc
103+
values:
104+
- "*.example.com"
105+
expected: |
106+
apiVersion: console.openshift.io/v1
107+
kind: ConsolePlugin
108+
spec:
109+
displayName: foo
110+
backend:
111+
type: Service
112+
contentSecurityPolicy:
113+
- directive: ScriptSrc
114+
values:
115+
- "*.example.com"
116+
- name: Should throw an error for invalid CSP directive values, starting and ending with quotes
117+
initial: |
118+
apiVersion: console.openshift.io/v1
119+
kind: ConsolePlugin
120+
spec:
121+
displayName: foo
122+
backend:
123+
type: Service
124+
contentSecurityPolicy:
125+
- directive: ScriptSrc
126+
values:
127+
- "'none'"
128+
expectedError: "\"string\": CSP directive value cannot contain a quote"
129+
- name: Should throw an error for invalid CSP directive values with quote
130+
initial: |
131+
apiVersion: console.openshift.io/v1
132+
kind: ConsolePlugin
133+
spec:
134+
displayName: foo
135+
backend:
136+
type: Service
137+
contentSecurityPolicy:
138+
- directive: ScriptSrc
139+
values:
140+
- "foo'bar"
141+
expectedError: "\"string\": CSP directive value cannot contain a quote"
142+
- name: Should throw an error for invalid CSP directive values with comma
143+
initial: |
144+
apiVersion: console.openshift.io/v1
145+
kind: ConsolePlugin
146+
spec:
147+
displayName: foo
148+
backend:
149+
type: Service
150+
contentSecurityPolicy:
151+
- directive: ScriptSrc
152+
values:
153+
- "foo,bar"
154+
expectedError: "spec.contentSecurityPolicy[0].values[0]: Invalid value: \"string\": CSP directive value cannot contain a comma"
155+
- name: Should throw an error for invalid CSP directive values with semi-colon
156+
initial: |
157+
apiVersion: console.openshift.io/v1
158+
kind: ConsolePlugin
159+
spec:
160+
displayName: foo
161+
backend:
162+
type: Service
163+
contentSecurityPolicy:
164+
- directive: ScriptSrc
165+
values:
166+
- "foo;bar"
167+
expectedError: "spec.contentSecurityPolicy[0].values[0]: Invalid value: \"string\": CSP directive value cannot contain a semi-colon"
168+
- name: Should throw an error for invalid CSP directive values with whitespace, using space
169+
initial: |
170+
apiVersion: console.openshift.io/v1
171+
kind: ConsolePlugin
172+
spec:
173+
displayName: foo
174+
backend:
175+
type: Service
176+
contentSecurityPolicy:
177+
- directive: ScriptSrc
178+
values:
179+
- https://scr ipt1.com/
180+
expectedError: "spec.contentSecurityPolicy[0].values[0]: Invalid value: \"string\": CSP directive value cannot contain a whitespace"
181+
- name: Should throw an error for invalid CSP directive values with whitespace, using tab
182+
initial: |
183+
apiVersion: console.openshift.io/v1
184+
kind: ConsolePlugin
185+
spec:
186+
displayName: foo
187+
backend:
188+
type: Service
189+
contentSecurityPolicy:
190+
- directive: ScriptSrc
191+
values:
192+
- https://scri pt1.com/
193+
expectedError: "spec.contentSecurityPolicy[0].values[0]: Invalid value: \"string\": CSP directive value cannot contain a whitespace"

‎console/v1/types_console_plugin.go‎

Lines changed: 127 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,11 +43,138 @@ type ConsolePluginSpec struct {
4343
Backend ConsolePluginBackend `json:"backend"`
4444
// proxy is a list of proxies that describe various service type
4545
// to which the plugin needs to connect to.
46+
// +listType=map
47+
// +listMapKey=alias
4648
// +optional
4749
Proxy []ConsolePluginProxy `json:"proxy,omitempty"`
4850
// i18n is the configuration of plugin's localization resources.
4951
// +optional
5052
I18n ConsolePluginI18n `json:"i18n"`
53+
// contentSecurityPolicy is a list of Content-Security-Policy (CSP) directives for the plugin.
54+
// Each directive specifies a list of values, appropriate for the given directive type,
55+
// for example a list of remote endpoints for fetch directives such as ScriptSrc.
56+
// Console web application uses CSP to detect and mitigate certain types of attacks,
57+
// such as cross-site scripting (XSS) and data injection attacks.
58+
// Dynamic plugins should specify this field if need to load assets from outside
59+
// the cluster or if violation reports are observed. Dynamic plugins should always prefer
60+
// loading their assets from within the cluster, either by vendoring them, or fetching
61+
// from a cluster service.
62+
// CSP violation reports can be viewed in the browser's console logs during development and
63+
// testing of the plugin in the OpenShift web console.
64+
// Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
65+
// Each of the available directives may be defined only once in the list.
66+
// The value 'self' is automatically included in all fetch directives by the OpenShift web
67+
// console's backend.
68+
// For more information about the CSP directives, see:
69+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
70+
//
71+
// The OpenShift web console server aggregates the CSP directives and values across
72+
// its own default values and all enabled ConsolePlugin CRs, merging them into a single
73+
// policy string that is sent to the browser via `Content-Security-Policy` HTTP response header.
74+
//
75+
// Example:
76+
// ConsolePlugin A directives:
77+
// script-src: https://script1.com/, https://script2.com/
78+
// font-src: https://font1.com/
79+
//
80+
// ConsolePlugin B directives:
81+
// script-src: https://script2.com/, https://script3.com/
82+
// font-src: https://font2.com/
83+
// img-src: https://img1.com/
84+
//
85+
// Unified set of CSP directives, passed to the OpenShift web console server:
86+
// script-src: https://script1.com/, https://script2.com/, https://script3.com/
87+
// font-src: https://font1.com/, https://font2.com/
88+
// img-src: https://img1.com/
89+
//
90+
// OpenShift web console server CSP response header:
91+
// Content-Security-Policy: default-src 'self'; base-uri 'self'; script-src 'self' https://script1.com/ https://script2.com/ https://script3.com/; font-src 'self' https://font1.com/ https://font2.com/; img-src 'self' https://img1.com/; style-src 'self'; frame-src 'none'; object-src 'none'
92+
//
93+
// +openshift:enable:FeatureGate=ConsolePluginContentSecurityPolicy
94+
// +kubebuilder:validation:MaxItems=5
95+
// +kubebuilder:validation:XValidation:rule="self.map(x, x.values.map(y, y.size()).sum()).sum() < 8192",message="the total combined size of values of all directives must not exceed 8192 (8kb)"
96+
// +listType=map
97+
// +listMapKey=directive
98+
// +optional
99+
ContentSecurityPolicy []ConsolePluginCSP `json:"contentSecurityPolicy"`
100+
}
101+
102+
// DirectiveType is an enumeration of OpenShift web console supported CSP directives.
103+
// LoadType is an enumeration of i18n loading types.
104+
// +kubebuilder:validation:Enum:="DefaultSrc";"ScriptSrc";"StyleSrc";"ImgSrc";"FontSrc"
105+
// +enum
106+
type DirectiveType string
107+
108+
const (
109+
// DefaultSrc directive serves as a fallback for the other CSP fetch directives.
110+
// For more information about the DefaultSrc directive, see:
111+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
112+
DefaultSrc DirectiveType = "DefaultSrc"
113+
// ScriptSrc directive specifies valid sources for JavaScript.
114+
// For more information about the ScriptSrc directive, see:
115+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
116+
ScriptSrc DirectiveType = "ScriptSrc"
117+
// StyleSrc directive specifies valid sources for stylesheets.
118+
// For more information about the StyleSrc directive, see:
119+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
120+
StyleSrc DirectiveType = "StyleSrc"
121+
// ImgSrc directive specifies a valid sources of images and favicons.
122+
// For more information about the ImgSrc directive, see:
123+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
124+
ImgSrc DirectiveType = "ImgSrc"
125+
// FontSrc directive specifies valid sources for fonts loaded using @font-face.
126+
// For more information about the FontSrcdirective, see:
127+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
128+
FontSrc DirectiveType = "FontSrc"
129+
)
130+
131+
// CSPDirectiveValue is single value for a Content-Security-Policy directive.
132+
// Each directive value must have a maximum length of 1024 characters and must not contain
133+
// whitespace, commas (,), semicolons (;) or single quotes ('). The value '*' is not permitted.
134+
// +kubebuilder:validation:MinLength=1
135+
// +kubebuilder:validation:MaxLength=1024
136+
// +kubebuilder:validation:XValidation:rule="!self.contains(\"'\")",message="CSP directive value cannot contain a quote"
137+
// +kubebuilder:validation:XValidation:rule="!self.matches('\\\\s')",message="CSP directive value cannot contain a whitespace"
138+
// +kubebuilder:validation:XValidation:rule="!self.contains(',')",message="CSP directive value cannot contain a comma"
139+
// +kubebuilder:validation:XValidation:rule="!self.contains(';')",message="CSP directive value cannot contain a semi-colon"
140+
// +kubebuilder:validation:XValidation:rule="self != '*'",message="CSP directive value cannot be a wildcard"
141+
type CSPDirectiveValue string
142+
143+
// ConsolePluginCSP holds configuration for a specific CSP directive
144+
type ConsolePluginCSP struct {
145+
// directive specifies which Content-Security-Policy directive to configure.
146+
// Available directive types are DefaultSrc, ScriptSrc, StyleSrc, ImgSrc and FontSrc.
147+
// DefaultSrc directive serves as a fallback for the other CSP fetch directives.
148+
// For more information about the DefaultSrc directive, see:
149+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
150+
// ScriptSrc directive specifies valid sources for JavaScript.
151+
// For more information about the ScriptSrc directive, see:
152+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src
153+
// StyleSrc directive specifies valid sources for stylesheets.
154+
// For more information about the StyleSrc directive, see:
155+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src
156+
// ImgSrc directive specifies a valid sources of images and favicons.
157+
// For more information about the ImgSrc directive, see:
158+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/img-src
159+
// FontSrc directive specifies valid sources for fonts loaded using @font-face.
160+
// For more information about the FontSrc directive, see:
161+
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/font-src
162+
// +kubebuilder:validation:Required
163+
Directive DirectiveType `json:"directive"`
164+
// values defines an array of values to append to the console defaults for this directive.
165+
// Each ConsolePlugin may define their own directives with their values. These will be set
166+
// by the OpenShift web console's backend, as part of its Content-Security-Policy header.
167+
// The array can contain at most 16 values. Each directive value must have a maximum length
168+
// of 1024 characters and must not contain whitespace, commas (,), semicolons (;) or single
169+
// quotes ('). The value '*' is not permitted.
170+
// Each value in the array must be unique.
171+
//
172+
// +kubebuilder:validation:Required
173+
// +kubebuilder:validation:MinItems=1
174+
// +kubebuilder:validation:MaxItems=16
175+
// +kubebuilder:validation:XValidation:rule="self.all(x, self.exists_one(y, x == y))",message="each CSP directive value must be unique"
176+
// +listType=atomic
177+
Values []CSPDirectiveValue `json:"values"`
51178
}
52179

53180
// LoadType is an enumeration of i18n loading types

0 commit comments

Comments
 (0)