Support Content Security Policy (a.k.a CSP) to help protect against XSS

[eclipse-rap]

Support Content Security Policy (a.k.a CSP) to help protect against XSS

[mknauer]

For the complete discussion around the implementation, please read bug 579074 in Bugzilla before the GitHub migration.

The feature has been implemented with

• commit 51e9303 (Add possibility to set Content Security Policy) and with
• commit 74ad8f5 (Eliminate "new Function()" calls in JS client).

[mknauer]

Added the ability to set a Content Security Policy (string with directives) to the RAP application. The implementation is based on the script nonce attribute, whereby only allowed scripts are executed.

Content-Security-Policy: script-src 'nonce-2726c7f26c'

A dynamically generated nonce value will be added at runtime. Use 'nonce-' in your script-src directive. Example of CSP:

script-src 'strict-dynamic' 'nonce-' http: https:; object-src 'none'; base-uri 'none';

For a workbench application, the CSP can be set in a new csp attribute of the entrypoint extension in plugin.xml. In other cases, use the new org.eclipse.rap.rwt.client.WebClient.CSP property when defining an entrypoint in the ApplicationConfiguration.

public class MyApplication implements ApplicationConfiguration {

  public void configure( Application application ) {
    Map properties = new HashMap();
    ...
    properties.put( WebClient.CSP, "script-src 'strict-dynamic' 'nonce-' http: https:; object-src 'none'; base-uri 'none';" );
    application.addEntryPoint( "/", MyApp.class, properties );
  }
}

Note: Without 'unsafe-eval' in your CSP script-src directive, the following RAP features will not work:

• org.eclipse.swt.browser.Browser.execute(String)
• org.eclipse.swt.browser.Browser.evaluate(String)
• org.eclipse.swt.browser.Browser.evaluate(String, BrowserCallback)
• org.eclipse.swt.browser.BrowserFunction
• org.eclipse.rap.rwt.scripting.ClientListener
• org.eclipse.rap.rwt.client.service.JavaScriptExecutor