[java-idp-plugin-oidc-rp] branch main updated: JOIDCRP-49 - Add CSP protection to views

[Phil Smart]

This is an automated email from the git hooks/post-receive script.

philsmart pushed a commit to branch main
in repository java-idp-plugin-oidc-rp.

View the commit online:
http://git.shibboleth.net/view/?p=java-idp-plugin-oidc-rp.git;a=commit;h=344a61da9f1b1a24f3d3f562077052c950b571ff

The following commit(s) were added to refs/heads/main by this push:
     new 344a61d  JOIDCRP-49 - Add CSP protection to views
344a61d is described below

commit 344a61da9f1b1a24f3d3f562077052c950b571ff
Author: Phil Smart <philip.smart at jisc.ac.uk>
AuthorDate: Thu Nov 2 09:49:41 2023 +0000

    JOIDCRP-49 - Add CSP protection to views
    
     - Add cspDigester and cspNonceGenerator beans to
    HTTPPostAuthnRequestEncoder
     - Add CSP policy to oidc request form post velocity template
    
    https://shibboleth.atlassian.net/browse/JOIDCRP-49
---
 .../oidc-relying-party-authn-beans.xml             | 30 +++++++++++++++++++++-
 .../resources/templates/oidc-request-form-post.vm  |  8 +++++-
 2 files changed, 36 insertions(+), 2 deletions(-)

diff --git a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
index a733ee7..de997b7 100644
--- a/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
+++ b/idp-oidc-rp-impl/src/main/resources/META-INF/net/shibboleth/idp/flows/authn/OIDCRelyingParty/oidc-relying-party-authn-beans.xml
@@ -256,7 +256,9 @@
     <bean id="HTTPPostAuthnRequestEncoder"
         class="net.shibboleth.oidc.profile.encoding.impl.HTTPPostAuthnRequestEncoder" init-method="" scope="prototype"
         p:velocityEngine-ref="shibboleth.VelocityEngine" p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier"
-        p:authorizationParamsAreValidPredicate="#{getObject('shibboleth.authn.oidc.rp.AuthzParamsValidPredicate')}" />
+        p:authorizationParamsAreValidPredicate="#{getObject('shibboleth.authn.oidc.rp.AuthzParamsValidPredicate')}" 
+        p:cSPDigester-ref="RPCSPDigester"
+        p:cSPNonceGenerator-ref="RPCSPNonce"/>
 
     <bean id="EncodeMessage" class="org.opensaml.profile.action.impl.EncodeMessage" scope="prototype"
         p:messageEncoderFactory-ref="messageEncoderFactory" p:httpServletResponseSupplier-ref="shibboleth.HttpServletResponseSupplier" />
@@ -893,6 +895,32 @@
         location of the user config file. -->
     <import
         resource="conditional:%{idp.home}/conf/authn/%{shibboleth.authn.oidc.rp.user.config:oidc-rp-config.xml}" />
+        
+        
+        
+    <!-- Used in views to calculate CSP hashes and nonces, remove and adjust beans in flow when compatibility bumped past 5.0 -->
+    
+    <bean id="RPCSPDigester" class="net.shibboleth.shared.codec.StringDigester"
+        c:algorithm="SHA256" c:format="BASE64" />
+
+    <bean id="RPCSPNonce" destroy-method=""
+            class="net.shibboleth.shared.security.IdentifierGenerationStrategy" factory-method="getInstance">
+        <constructor-arg>
+            <util:constant
+                static-field="net.shibboleth.shared.security.IdentifierGenerationStrategy.ProviderType.SECURE" />
+        </constructor-arg>
+        <constructor-arg>
+            <bean class="net.shibboleth.shared.security.RandomIdentifierParameterSpec"
+                    c:identifierSize="16">
+                <constructor-arg name="source">
+                    <null/>
+                </constructor-arg>
+                <constructor-arg name="identifierEncoder">
+                    <null/>
+                </constructor-arg>
+            </bean>
+        </constructor-arg>
+    </bean>
 
 
 </beans>
diff --git a/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm b/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm
index 2a674f4..eb445e6 100644
--- a/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm
+++ b/idp-oidc-rp-impl/src/main/resources/templates/oidc-request-form-post.vm
@@ -1,7 +1,13 @@
 ##
 ## Velocity Template for OIDC Form Post response mode.
+## cspDigester - Calculates base64-encoded SHA-2 hashes (call apply). Can be null for backward compatibility.
+## cspNonce - Calculates secure nonces (call generateIdentifier). Can be null for backward compatibility.
 ##
 ##
+#set ($onLoad = "document.forms[0].submit()")
+#if($cspDigester)
+    $response.addHeader("Content-Security-Policy","object-src 'none'; script-src 'none'; script-src-attr 'unsafe-hashes' 'sha256-$cspDigester.apply($onLoad)'")
+#end
 <!DOCTYPE html>
 <html>
 
@@ -9,7 +15,7 @@
     <meta charset="utf-8" />
 </head>
 
-<body onload="document.forms[0].submit()">
+<body onload="$onLoad">
     <noscript>
         <p>
             <strong>Note:</strong> Since your browser does not support JavaScript, you must press the Continue button once to proceed.

-- 
To stop receiving notification emails like this one, please contact
the administrator of this repository.