jacobbednarz/go-csp-collector

A CSP collector written in Golang

This is a content security policy violation collector written in Golang.

It has been designed to listen on port 8080 and accept POST payloads containing the violation report. It captures the report and will write it to STDOUT via Go's logger.

A neat little feature of this tool is that it automatically ignores unactionable reports. Check out the default list if you're interested.

Installation

$ go get github.com/jacobbednarz/go-csp-collector

Alternatively, you can download the binaries from the release page.

Running

$ go build -o csp_collector main.go
$ ./csp_collector

Endpoints

• POST /: accepts a CSP violation report (recommended to use /csp for future proofing though).
• POST /csp: accepts a CSP violation report.
• POST /csp/report-only: same as /csp but appends a report-only attribute to the log line. Helpful if you have enforced and report only violations and wish to separate them.

Building for Docker

You will either need to build within a docker container for the purpose, or use CGO_ENABLED=0 flag to make the build compatible with alpine linux in a docker container.

$ CGO_ENABLED=0 go build -o csp_collector main.go

Command Line Options

Flag	Description
version	Shows the version string before exiting
debug	Runs in debug mode producing more verbose output
port	Port to run on, default 8080
filter-file	Reads the blocked URI filter list from the specified file. Note one filter per line
health-check-path	Sets path for health checkers to use, default /_healthcheck
log-client-ip	Include a field in the log with the IP delivering the report, or the value of the X-Forwarded-For header, if present.
log-truncated-client-ip	Include a field in the log with the truncated IP (to /24 for IPv4, /64 for IPv6) delivering the report, or the value of the X-Forwarded-For header, if present. Conflicts with log-client-ip.
truncate-query-fragment	Remove all query strings and fragments (if set) from all URLs transmitted by the client
query-params-metadata	Log all query parameters of the report URL as a map in the metadata field

See the sample.filterlist.txt file as an example of the filter list in a file

Request metadata

Additional information can be attached to each report by adding a metadata url parameter to each report. That value will be copied verbatim into the logged report.

For example a report sent to https://collector.example.com/?metadata=foobar will include field metadata with value foobar.

If query-params-metadata is set, instead all query parameters are logged as a map, e.g. https://collector.example.com/?env=production&mode=enforce will result in "metadata": {"env": "production", "mode": "enforce"} in JSON format, and metadata="map[env:production mode:enforce]" in default format.

report-only mode

If you'd like to recieve report only violations on a different URL

Output formats

The output format can be controlled by passing --output-format <type> to the executable. Available formats are:

• Text: A key/value output that quotes all the values. Example: blocked_uri="about:blank" ...
• JSON: Single line, compressed JSON object. Example: {"blocked_uri":"about:blank"}

The default formatter is text.

Writing to a file instead of just STDOUT

If you'd rather have these violations end up in a file, I suggest just redirecting the output into a file like so:

$ ./csp_collector 2>> /path/to/violations.log

Visualisation

This project purposely doesn't try to solve the problem of visualing the violation data because there are already a bunch of great solutions out there. Once you have your violations being collected, be sure to slurp them into your favourite log aggregation tool.

Deployments

Currently supported deployment mechanisms:

• kubernetes/helm
• systemd

go-csp-collector's Issues

block domains instead of prefixes

I really appreciate this small software, I like to add my 2 cents on configuration of filter.txt file.

I need to ignore URLs like:

• https://gc.kis.v2.scr.kaspersky-labs.com
• https://ff.kis.v2.scr.kaspersky-labs.com

Probably an antivirus trying to access the webpage for some security check.

Instead of multiply the lines in the configuration file for each subdomain used by the software house, I'd like to ignore the domain kaspersky-labs.com entirely.

I'm not a developer but I think I could change this line:

go-csp-collector/internal/handler/csp.go

Line 128 in bc93b09

if strings.HasPrefix(r.Body.BlockedURI, value) {

and use strings.Contains instad of strings.HasPrefix, if you think is an acceptable change I'll try to arrange a PR for this.

Allow an array of reports

I'm getting this when reports are sent from chrome:

{"level":"debug","message":"Unable to decode invalid JSON payload: json: cannot unmarshal array into Go value of type main.CSPReport","timestamp":"2022-08-24T11:31:19Z"}

I think that chrome is sending multiple reports in an array.
I couldn't find it in the spec but this says:

As you can see, the report is part of an array of reports, since there can be multiple types of reports in a single Reporting API call.

Feature Request: Publish the Helm chart

Hi,

It would be nice if we could install the Helm chart directly without cloning the repository and made the Helm chart available on Artifact Hub.
The helm Chart can be automatically published with a Github Action workflow: https://github.com/helm/chart-releaser.

Thanks,

Alexandre

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate Limited

These updates are currently rate limited. Click on a checkbox below to force their creation now.

• Update golang Docker tag to v1.19

Ignored or Blocked

These are blocked by an existing closed PR and will not be recreated unless you click a checkbox below.

• Update module go to 1.19

Detected dependencies

dockerfile

Dockerfile

• golang 1.18-alpine
• alpine 3.16

github-actions

.github/workflows/test.yml

• actions/setup-go v3
• actions/checkout v3

gomod

go.mod

• go 1.18
• github.com/sirupsen/logrus v1.9.0

helm-values

deployments/kubernetes-helm/values.yaml

• jacobbednarz/go-csp-collector latest

---

• Check this box to trigger a request for Renovate to run again on this repository

Add support for NEL

Network Error Logging is becoming a thing via the [Reporting API] so it would be good to add support for it. Ideally, we would:

• Rename this repository to be something more generic
• Have support for CSP and NEL via an extensible interface
• Make it easy to add reporting API endpoints in the future

http code 422 when StatusCode is an int

With Google Chrome 70.0.3538.77 (Official Build) (64-bit), chrome is sending the status-code unquoted which is then interpreted as an int rather than a string.

eg (bad)

curl -vvv -H 'Content-Type: application/csp-report;charset=utf-8' --data '{"csp-report":{"document-uri":"https://example.com/foo/bar","referrer":"https://www.google.com/","violated-directive":"default-src self","original-policy":"default-src self; report-uri /csp-hotline.php","blocked-uri":"http://evilhackerscripts.com", "status-code": 0 }}' http://localhost:8080

If status-code is either omitted, or the value is quoted then things work fine.

I only noticed this after I upgraded from an earlier version of chrome.

Migrate to `go mod` once 1.11 is minimum support

Currently use govendor for dependency management but should move to go modules once we don't support < 1.11

ngon

Support source-file

Please support source-file, and perhaps line-number and column-number as well.

Firefox (at least) sends them, and I would fine the source file URI quite useful in my reports.

arm64 image for go-csp-collector

First of all thank you for your work on this useful project!

We run go-csp-collector in all our public-facing k8s cluster since ages, but we now want to migrate to all-ARM clusters and we miss an image supporting that architecture.

Would it be possible to extend the supported architectures on docker hub?
We would also volunteering to support the necessary actions therefore!

Invalid blocked URIs

Can't do anything with the following

wvjbscheme://__wvjb_queue_message__
nativebaiduhd://adblock
bdvideo://error