fanglingsu/vimb — pull request #133 by semarie (2014-10-24 14:15:50+00:00)
Title: Content security policy

Hi Carl,

I have implemented a setting to enforce Content-Security-Policy (see http://www.w3.org/TR/CSP/). Basically, it add a HTTP-Header on libsoup response, and when webkit process it, it manage the HTTP-Header as it would be send by the server.

The purpose is to have a system the user could setup to whitelist requests (I am on "https://github.com" so you could load any page in "github.com" domain or "githubusercontent.com" domain, but nowhere else).

In order to have a setting customisable by autocmd, I have change LoadProvisional for permit matching the uri (I take the uri of the provisonal data source). Webkit use the HTTP-Header setting before LoadCommited, so setting it here have no effect.

I have just a problem with autocmd: if the page perform a redirection, LoadProvisional isn't called a second time. So the wrong policy could be applied. For example: `https://www.oxdef.info/csp-reporter` will redirect to `https://github.com/yandex/csp-reporter`, but it is the policy for oxdef that will be applied.

The policy-errors are printed by webkit on terminal console the error message:
```
** Message: console message: @0: Refused to load the image 'https://camo.githubusercontent.com/stripped' because it violates the following Content Security Policy directive: "default-src 'self' 'unsafe-inline' 'unsafe-eval' data:". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.
```

As example, here a piece of the config I currently use:
```
augroup csp
# default for all sites: same domain only
autocmd LoadProvisional * set content-security-policy=default-src 'self'

# default for https sites: same domain + inline + data: scheme
autocmd LoadProvisional https://* set content-security-policy=default-src 'self' 'unsafe-inline' 'unsafe-eval' data:

# github configuration
# + any domain of github.com and githubusercontent.com
autocmd LoadProvisional https://github.com/* set content-security-policy=default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https://*.github.com/ https://*.githubusercontent.com/

autocmd LoadProvisional https://*.github.com/* set content-security-policy=default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https://*.github.com/ https://*.githubusercontent.com/

# twitter configuration
# + any domain from twitter.com and twimg.com
autocmd LoadProvisional https://twitter.com/* set content-security-policy=default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https://*.twitter.com/ https://*.twimg.com/

# mozilla.org configuration
# + any domain from mozilla.net
autocmd LoadProvisional https://*.mozilla.org/* set content-security-policy=default-src 'self' 'unsafe-inline' 'unsafe-eval' data: https://*.mozilla.net/
augroup end
```