[Bug 43832] New: Default CSP external cover images on the OPAC
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 Bug ID: 43832 Summary: Default CSP external cover images on the OPAC Initiative type: --- Sponsorship --- status: Product: Koha Version: Main Hardware: All OS: All Status: NEW Severity: normal Priority: P5 - low Component: Architecture, internals, and plumbing Assignee: koha-bugs@lists.koha-community.org Reporter: f.demians@tamil.fr QA Contact: testopia@bugs.koha-community.org Target Milestone: --- Since bug 38365, the OPAC can send a Content-Security-Policy header. When csp_mode is set to "enabled" and csp_header_value is left empty, Koha uses a hard-coded default policy (Koha/ContentSecurityPolicy.pm): default-src 'self'; script-src 'self' 'nonce-_CSP_NONCE_'; style-src 'self' 'nonce-_CSP_NONCE_'; style-src-attr 'unsafe-inline'; img-src 'self' data:; font-src 'self'; object-src 'none' This policy doesn't depend on system preferences. With it, every cover image service that loads its images, or its data, from another host stops working, without any message in the staff interface. Only local covers (OPACLocalCoverImages, OPACCustomCoverImages pointing to the Koha server) are displayed. koha-testing-docker enables the OPAC CSP, so this can be seen there: 1. In koha-conf.xml, set <csp_mode>enabled</csp_mode> for the OPAC, with an empty <csp_header_value> (the default in KTD), and restart_all. 2. Enable OPACAmazonCoverImages (or GoogleJackets, OpenLibraryCovers). 3. Open the detail page of a record with an ISBN on the OPAC. 4. No cover is displayed. The browser console reports CSP violations. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 Frédéric Demians <f.demians@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |Needs Signoff -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #1 from Frédéric Demians <f.demians@tamil.fr> --- Created attachment 208236 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208236&action=edit Bug 43832: Document CSP sources for cover image services The hard-coded Content-Security-Policy only allows images served by Koha. With csp_mode set to "enabled", the OPAC cover image services loading their images, or their data with JSONP, from another host stop working: Amazon, Google, Open Library, Syndetics and Coce. This patch documents, in koha-conf.xml and in the koha-conf template of the Debian packages, the sources to add to a custom csp_header_value for each of these services, with an example of OPAC policy. Test plan: 1. In koha-conf.xml (/etc/koha/sites/kohadev/koha-conf.xml in KTD), set <csp_mode>enabled</csp_mode> for the OPAC with an empty <csp_header_value>, and restart_all. 2. Enable OPACAmazonCoverImages, and open the detail page of a record with an ISBN on the OPAC (biblionumber=6 in KTD sample data): no cover, the browser console reports a CSP violation on img-src. 3. Disable OPACAmazonCoverImages and repeat with GoogleJackets, then OpenLibraryCovers: no cover, a CSP violation on script-src. 4. Repeat with OpacCoce, CoceHost=https://coce.tamil.fr, CoceProviders=aws,gb,ol: no cover, a CSP violation on script-src. 5. Apply this patch and read the new "Cover images" paragraph of the CSP documentation in etc/koha-conf.xml. 6. Copy the example policy into <csp_header_value>, replacing coce.example.org by coce.tamil.fr, and add to script-src https://books.google.com https://openlibrary.org. restart_all. 7. Repeat steps 2 to 4: the covers are displayed, without CSP violation. 8. Check that debian/templates/koha-conf-site.xml.in has the same paragraph. Syndetics needs a client code and could not be tested; its host, secure.syndetics.com, is the one used by the OPAC templates. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #2 from Frédéric Demians <f.demians@tamil.fr> --- Created attachment 208237 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208237&action=edit Bug 43832: Add a CSP note to cover image preferences The cover image preferences of the OPAC don't work when the OPAC Content-Security-Policy is enabled with Koha hard-coded policy. This patch adds a note to their description, pointing to the documentation of koha-conf.xml added by the previous patch: - OPACAmazonCoverImages - GoogleJackets - OpenLibraryCovers - SyndeticsCoverImages - OpacCoce Test plan: 1. Apply this patch. 2. Go to Administration > System preferences > Enhanced content. 3. Check that the five preferences above have a note about the OPAC Content-Security-Policy below their description. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Needs Signoff |Signed Off Patch complexity|--- |Small patch -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 Owen Leonard <oleonard@myacpl.org> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #208236|0 |1 is obsolete| | Attachment #208237|0 |1 is obsolete| | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #3 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 208330 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208330&action=edit Bug 43832: Document CSP sources for cover image services The hard-coded Content-Security-Policy only allows images served by Koha. With csp_mode set to "enabled", the OPAC cover image services loading their images, or their data with JSONP, from another host stop working: Amazon, Google, Open Library, Syndetics and Coce. This patch documents, in koha-conf.xml and in the koha-conf template of the Debian packages, the sources to add to a custom csp_header_value for each of these services, with an example of OPAC policy. Test plan: 1. In koha-conf.xml (/etc/koha/sites/kohadev/koha-conf.xml in KTD), set <csp_mode>enabled</csp_mode> for the OPAC with an empty <csp_header_value>, and restart_all. 2. Enable OPACAmazonCoverImages, and open the detail page of a record with an ISBN on the OPAC (biblionumber=6 in KTD sample data): no cover, the browser console reports a CSP violation on img-src. 3. Disable OPACAmazonCoverImages and repeat with GoogleJackets, then OpenLibraryCovers: no cover, a CSP violation on script-src. 4. Repeat with OpacCoce, CoceHost=https://coce.tamil.fr, CoceProviders=aws,gb,ol: no cover, a CSP violation on script-src. 5. Apply this patch and read the new "Cover images" paragraph of the CSP documentation in etc/koha-conf.xml. 6. Copy the example policy into <csp_header_value>, replacing coce.example.org by coce.tamil.fr, and add to script-src https://books.google.com https://openlibrary.org. restart_all. 7. Repeat steps 2 to 4: the covers are displayed, without CSP violation. 8. Check that debian/templates/koha-conf-site.xml.in has the same paragraph. Syndetics needs a client code and could not be tested; its host, secure.syndetics.com, is the one used by the OPAC templates. Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #4 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 208331 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208331&action=edit Bug 43832: Add a CSP note to cover image preferences The cover image preferences of the OPAC don't work when the OPAC Content-Security-Policy is enabled with Koha hard-coded policy. This patch adds a note to their description, pointing to the documentation of koha-conf.xml added by the previous patch: - OPACAmazonCoverImages - GoogleJackets - OpenLibraryCovers - SyndeticsCoverImages - OpacCoce Test plan: 1. Apply this patch. 2. Go to Administration > System preferences > Enhanced content. 3. Check that the five preferences above have a note about the OPAC Content-Security-Policy below their description. Signed-off-by: Owen Leonard <oleonard@myacpl.org> -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #5 from Owen Leonard <oleonard@myacpl.org> --- Created attachment 208332 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208332&action=edit Bug 43832: (follow-up) Update wording of preference note Also adding a similar note to preferences which affect the staff interfaces. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #6 from Frédéric Demians <f.demians@tamil.fr> --- Thanks Owen for the sign-off and for the rewording, which reads better! I see that koha-conf.xml warns that the staff interface is "not yet production ready" for the CSP "enabled" mode, so the staff notes are less urgent than the OPAC ones. So I'd prefer not to deal this situation. And, side note, my patches missed too: CustomCoverImages and OPACCustomCoverImages... -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 Frédéric Demians <f.demians@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Status|Signed Off |Needs Signoff -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 Frédéric Demians <f.demians@tamil.fr> changed: What |Removed |Added ---------------------------------------------------------------------------- Attachment #208330|0 |1 is obsolete| | Attachment #208331|0 |1 is obsolete| | Attachment #208332|0 |1 is obsolete| | -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #7 from Frédéric Demians <f.demians@tamil.fr> --- Created attachment 208346 --> https://bugs.koha-community.org/bugzilla3/attachment.cgi?id=208346&action=edit Bug 43832: Document CSP sources for OPAC cover image services The hard-coded Content-Security-Policy only allows images served by Koha. With csp_mode set to "enabled", the OPAC cover image services loading their images, or their data with JSONP, from another host stop working: Amazon, Google, Open Library, Syndetics and Coce. This patch: - documents, in koha-conf.xml and in the koha-conf template of the Debian packages, the sources to add to a custom csp_header_value for each of these services, with an example of OPAC policy; - adds a note to the OPAC cover image preferences, pointing to this documentation: OPACAmazonCoverImages, GoogleJackets, OpenLibraryCovers, SyndeticsCoverImages and OpacCoce. The wording of the note is Owen's. Only the OPAC is concerned: koha-conf.xml warns that the staff interface is not yet production ready for the "enabled" mode, so the CSP doesn't apply there for now. The staff interface preferences can get the same documentation when it does. Test plan: 1. In koha-conf.xml (/etc/koha/sites/kohadev/koha-conf.xml in KTD), set <csp_mode>enabled</csp_mode> for the OPAC with an empty <csp_header_value>, and restart_all. 2. Enable OPACAmazonCoverImages, and open the detail page of a record with an ISBN on the OPAC (biblionumber=6 in KTD sample data): no cover, the browser console reports a CSP violation on img-src. 3. Disable OPACAmazonCoverImages and repeat with GoogleJackets, then OpenLibraryCovers: no cover, a CSP violation on script-src. 4. Repeat with OpacCoce, CoceHost=https://coce.tamil.fr, CoceProviders=aws,gb,ol: no cover, a CSP violation on script-src. 5. Apply this patch and read the new "Cover images" paragraph of the CSP documentation in etc/koha-conf.xml. 6. Copy the example policy into <csp_header_value>, replacing coce.example.org by coce.tamil.fr, and add to script-src https://books.google.com https://openlibrary.org. restart_all. 7. Repeat steps 2 to 4: the covers are displayed, without CSP violation. 8. Check that debian/templates/koha-conf-site.xml.in has the same paragraph. 9. Go to Administration > System preferences > Enhanced content, and check that the five preferences above have a note about the OPAC Content Security Policy below their description. Syndetics needs a client code and could not be tested; its host, secure.syndetics.com, is the one used by the OPAC templates. -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #8 from Owen Leonard <oleonard@myacpl.org> ---
I see that koha-conf.xml warns that the staff interface is "not yet production ready" for the CSP "enabled" mode
Ah, got it! -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #9 from Owen Leonard <oleonard@myacpl.org> --- I don't know if the example is meant to be comprehensive but I found I also need ed these in the script-src section: https://books.google.com https://openlibrary.org And these in the img-src section: https://openlibrary.org https://archive.org -- You are receiving this mail because: You are the assignee for the bug. You are watching all bug changes.
https://bugs.koha-community.org/bugzilla3/show_bug.cgi?id=43832 --- Comment #10 from Frédéric Demians <f.demians@tamil.fr> --- (In reply to Owen Leonard from comment #9)
I don't know if the example is meant to be comprehensive but I found I also need ed these in the script-src section:
https://books.google.com https://openlibrary.org
And these in the img-src section:
It's supposed to be documented in koha-conf.xml, per provider: - GoogleJackets: script-src https://books.google.com img-src https://books.google.com CSP is a clear nuisance. Otherwise, instead of having admins configure CSP permissions for cover providers one by one, we could just as well settle on an exhaustive list of these providers. After all, their URLs should be very, very stable and safe. -- You are receiving this mail because: You are watching all bug changes. You are the assignee for the bug.
participants (1)
-
bugzilla-daemon＠bugs.koha-community.org