fix(security): add Content-Security-Policy header to web gateway

[zmanian]

Supersedes #514.

Why this replacement exists:

• the original PR branch lives on difflabai/ironclaw
• this credential could not push the required rebase/conflict fix back to that fork
• this branch carries the same CSP hardening rebased onto current staging

Additional adjustment included after #510:

• script-src now allows both https://cdn.jsdelivr.net and https://cdnjs.cloudflare.com
• that keeps the new DOMPurify CDN from fix(security): replace regex HTML sanitizer with DOMPurify to prevent XSS #510 compatible with the CSP header and regression test

Please review/merge this replacement instead of the original blocked PR.

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the security posture of the web gateway by introducing a Content-Security-Policy header. This measure helps protect users from malicious content injection and ensures that only trusted sources are allowed to execute scripts or load resources, building upon previous security efforts and incorporating necessary adjustments for external dependencies.

Highlights

• Security Enhancement: Implemented a Content-Security-Policy (CSP) header for the web gateway to mitigate various types of attacks, such as Cross-Site Scripting (XSS) and data injection.
• CSP Configuration: Configured the CSP to allow self for most directives, with specific allowances for script-src (including https://cdn.jsdelivr.net and https://cdnjs.cloudflare.com) and style-src (including https://fonts.googleapis.com and unsafe-inline).
• Regression Testing: Added a new integration test to verify the presence and correct content of the Content-Security-Policy header on web gateway responses, ensuring the security measure is properly applied.

Changelog

• src/channels/web/server.rs
  • Added a new SetResponseHeaderLayer to include the Content-Security-Policy header in all web gateway responses.
  • Defined a comprehensive CSP string with directives for default-src, script-src, style-src, font-src, connect-src, img-src, object-src, frame-ancestors, base-uri, and form-action.
  • Introduced a new #[tokio::test] function, test_csp_header_present_on_responses, to assert the presence and specific content of the CSP header in HTTP responses.

Activity

• This pull request supersedes fix(security): add Content-Security-Policy header to web gateway #514, which was blocked due to branch management issues.
• The changes from the original PR have been rebased onto the current staging branch.
• Adjustments were made to the script-src directive to include https://cdn.jsdelivr.net and https://cdnjs.cloudflare.com to maintain compatibility with the new DOMPurify CDN introduced in fix(security): replace regex HTML sanitizer with DOMPurify to prevent XSS #510.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request is a great security enhancement, adding a Content-Security-Policy header to the web gateway. The implementation is solid and includes a valuable test case to ensure the header is present and correct. My primary feedback is a suggestion to further harden the CSP by removing 'unsafe-inline' from the style-src directive, which would provide stronger protection against XSS attacks.

[gemini-code-assist]

The style-src directive includes 'unsafe-inline', which allows the use of inline <style> blocks and style attributes. This is a potential security risk as it can be a vector for Cross-Site Scripting (XSS) if an attacker finds a way to inject content into the page.

This is likely needed due to style="display: none;" attributes in src/channels/web/static/index.html. To improve security, I recommend refactoring the frontend code to use a CSS class for controlling visibility instead of inline styles. For example:

CSS:

.hidden {
  display: none;
}

JavaScript:

// To hide
element.classList.add('hidden');

// To show
element.classList.remove('hidden');

This change would allow you to remove 'unsafe-inline' from the CSP, making it more robust.

Suggested change

	style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; \
	style-src 'self' https://fonts.googleapis.com; \