Skip to content

Commit 6b619f4

Browse files
sameersbnsameersbn
authored
Merge pull request #2311 from sue445/csp_params
Add content_security_policy params
2 parents 10d1389 + b820c61 commit 6b619f4

File tree

4 files changed

+81
-18
lines changed

4 files changed

+81
-18
lines changed

‎README.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -924,6 +924,24 @@ Below is the complete list of available options that can be used to customize yo
924924
| `GITLAB_MONITORING_SIDEKIQ_EXPORTER_ENABLED` | Set to `true` to enable the sidekiq exporter, enabled by default. |
925925
| `GITLAB_MONITORING_SIDEKIQ_EXPORTER_ADDRESS` | Sidekiq exporter address, defaults to `0.0.0.0` |
926926
| `GITLAB_MONITORING_SIDEKIQ_EXPORTER_PORT` | Sidekiq exporter port, defaults to `3807` |
927+
| `GITLAB_CONTENT_SECURITY_POLICY_ENABLED` | Set to `true` to enable [Content Security Policy](https://guides.rubyonrails.org/security.html#content-security-policy), enabled by default. |
928+
| `GITLAB_CONTENT_SECURITY_POLICY_REPORT_ONLY` | Set to `true` to set `Content-Security-Policy-Report-Only` header, disabled by default |
929+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_BASE_URI` | The value of the `base-uri` directive in the `Content-Security-Policy` header |
930+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CHILD_SRC` | The value of the `child-src` directive in the `Content-Security-Policy` header |
931+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CONNECT_SRC` | The value of the `connect-src` directive in the `Content-Security-Policy` header. Default to `'self' http://localhost:* ws://localhost:* wss://localhost:*` |
932+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_DEFAULT_SRC` | The value of the `default-src` directive in the `Content-Security-Policy` header. Default to `'self'` |
933+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FONT_SRC` | The value of the `font-src` directive in the `Content-Security-Policy` header |
934+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FORM_ACTION` | The value of the `form-action` directive in the `Content-Security-Policy` header |
935+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_ANCESTORS` | The value of the `frame-ancestors` directive in the `Content-Security-Policy` header. Default to `'self'` |
936+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_SRC` | The value of the `frame-src` directive in the `Content-Security-Policy` header. Default to `'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com` |
937+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_IMG_SRC` | The value of the `img-src` directive in the `Content-Security-Policy` header. Default to `* data: blob:` |
938+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MANIFEST_SRC` | The value of the `manifest-src` directive in the `Content-Security-Policy` header |
939+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MEDIA_SRC` | The value of the `media-src` directive in the `Content-Security-Policy` header |
940+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_OBJECT_SRC` | The value of the `object-src` directive in the `Content-Security-Policy` header. Default to `'none'` |
941+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_SCRIPT_SRC` | The value of the `script-src` directive in the `Content-Security-Policy` header. Default to `'self' 'unsafe-eval' http://localhost:* https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com` |
942+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_STYLE_SRC` | The value of the `style-src` directive in the `Content-Security-Policy` header. Default to `'self' 'unsafe-inline'` |
943+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_WORKER_SRC` | The value of the `worker-src` directive in the `Content-Security-Policy` header. Default to `'self' blob:` |
944+
| `GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_REPORT_URI` | The value of the `report-uri` directive in the `Content-Security-Policy` header |
927945
| `SSL_SELF_SIGNED` | Set to `true` when using self signed ssl certificates. `false` by default. |
928946
| `SSL_CERTIFICATE_PATH` | Location of the ssl certificate. Defaults to `/home/git/data/certs/gitlab.crt` |
929947
| `SSL_KEY_PATH` | Location of the ssl private key. Defaults to `/home/git/data/certs/gitlab.key` |

‎assets/runtime/config/gitlabhq/gitlab.yml‎

Lines changed: 18 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -53,25 +53,25 @@ production: &base
5353
# Content Security Policy
5454
# See https://guides.rubyonrails.org/security.html#content-security-policy
5555
content_security_policy:
56-
enabled: true
57-
report_only: false
56+
enabled: {{GITLAB_CONTENT_SECURITY_POLICY_ENABLED}}
57+
report_only: {{GITLAB_CONTENT_SECURITY_POLICY_REPORT_ONLY}}
5858
directives:
59-
base_uri:
60-
child_src:
61-
connect_src: "'self' http://localhost:* ws://localhost:* wss://localhost:*"
62-
default_src: "'self'"
63-
font_src:
64-
form_action:
65-
frame_ancestors: "'self'"
66-
frame_src: "'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com"
67-
img_src: "* data: blob:"
68-
manifest_src:
69-
media_src:
70-
object_src: "'none'"
71-
script_src: "'self' 'unsafe-eval' http://localhost:* https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"
72-
style_src: "'self' 'unsafe-inline'"
73-
worker_src: "'self' blob:"
74-
report_uri:
59+
base_uri: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_BASE_URI}}"
60+
child_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CHILD_SRC}}"
61+
connect_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CONNECT_SRC}}"
62+
default_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_DEFAULT_SRC}}"
63+
font_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FONT_SRC}}"
64+
form_action: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FORM_ACTION}}"
65+
frame_ancestors: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_ANCESTORS}}"
66+
frame_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_SRC}}"
67+
img_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_IMG_SRC}}"
68+
manifest_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MANIFEST_SRC}}"
69+
media_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MEDIA_SRC}}"
70+
object_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_OBJECT_SRC}}"
71+
script_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_SCRIPT_SRC}}"
72+
style_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_STYLE_SRC}}"
73+
worker_src: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_WORKER_SRC}}"
74+
report_uri: "{{GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_REPORT_URI}}"
7575

7676
# Trusted Proxies
7777
# Customize if you have GitLab behind a reverse proxy which is running on a different machine.

‎assets/runtime/env-defaults‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -517,3 +517,24 @@ SENTRY_ENABLED=${SENTRY_ENABLED:-false}
517517
SENTRY_DSN=${SENTRY_DSN:-}
518518
SENTRY_CLIENTSIDE_DSN=${SENTRY_CLIENTSIDE_DSN:-}
519519
SENTRY_ENVIRONMENT=${SENTRY_ENVIRONMENT:-production}
520+
521+
## Content Security Policy
522+
# See https://guides.rubyonrails.org/security.html#content-security-policy
523+
GITLAB_CONTENT_SECURITY_POLICY_ENABLED=${GITLAB_CONTENT_SECURITY_POLICY_ENABLED:-true}
524+
GITLAB_CONTENT_SECURITY_POLICY_REPORT_ONLY=${GITLAB_CONTENT_SECURITY_POLICY_REPORT_ONLY:-false}
525+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_BASE_URI=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_BASE_URI:-}
526+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CHILD_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CHILD_SRC:-}
527+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CONNECT_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CONNECT_SRC:-"'self' http://localhost:* ws://localhost:* wss://localhost:*"}
528+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_DEFAULT_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_DEFAULT_SRC:-"'self'"}
529+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FONT_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FONT_SRC:-}
530+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FORM_ACTION=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FORM_ACTION:-}
531+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_ANCESTORS=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_ANCESTORS:-"'self'"}
532+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_SRC:-"'self' https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://content.googleapis.com https://content-compute.googleapis.com https://content-cloudbilling.googleapis.com https://content-cloudresourcemanager.googleapis.com"}
533+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_IMG_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_IMG_SRC:-"* data: blob:"}
534+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MANIFEST_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MANIFEST_SRC:-}
535+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MEDIA_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MEDIA_SRC:-}
536+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_OBJECT_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_OBJECT_SRC:-"'none'"}
537+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_SCRIPT_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_SCRIPT_SRC:-"'self' 'unsafe-eval' http://localhost:* https://www.google.com/recaptcha/ https://www.recaptcha.net/ https://www.gstatic.com/recaptcha/ https://apis.google.com"}
538+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_STYLE_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_STYLE_SRC:-"'self' 'unsafe-inline'"}
539+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_WORKER_SRC=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_WORKER_SRC:-"'self' blob:"}
540+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_REPORT_URI=${GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_REPORT_URI:-}

‎assets/runtime/functions‎

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1166,6 +1166,29 @@ gitlab_configure_sentry(){
11661166
SENTRY_ENVIRONMENT
11671167
}
11681168

1169+
gitlab_configure_content_security_policy(){
1170+
echo "Configuring gitlab::content_security_policy..."
1171+
update_template ${GITLAB_CONFIG} \
1172+
GITLAB_CONTENT_SECURITY_POLICY_ENABLED \
1173+
GITLAB_CONTENT_SECURITY_POLICY_REPORT_ONLY \
1174+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_BASE_URI \
1175+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CHILD_SRC \
1176+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_CONNECT_SRC \
1177+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_DEFAULT_SRC \
1178+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FONT_SRC \
1179+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FORM_ACTION \
1180+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_ANCESTORS \
1181+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_FRAME_SRC \
1182+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_IMG_SRC \
1183+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MANIFEST_SRC \
1184+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_MEDIA_SRC \
1185+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_OBJECT_SRC \
1186+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_SCRIPT_SRC \
1187+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_STYLE_SRC \
1188+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_WORKER_SRC \
1189+
GITLAB_CONTENT_SECURITY_POLICY_DIRECTIVES_REPORT_URI
1190+
}
1191+
11691192
nginx_configure_gitlab_ssl() {
11701193
if [[ ${GITLAB_HTTPS} == true && -f ${SSL_CERTIFICATE_PATH} && -f ${SSL_KEY_PATH} && -f ${SSL_DHPARAM_PATH} ]]; then
11711194
echo "Configuring nginx::gitlab::ssl..."
@@ -1681,6 +1704,7 @@ configure_gitlab() {
16811704
gitlab_configure_pages
16821705
gitlab_configure_sentry
16831706
generate_healthcheck_script
1707+
gitlab_configure_content_security_policy
16841708

16851709
# remove stale gitlab.socket
16861710
rm -rf ${GITLAB_INSTALL_DIR}/tmp/sockets/gitlab.socket

0 commit comments

Comments
 (0)