Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Adds a Content Security Policy (CSP) check for production environments #21874

Merged
merged 3 commits into from
Oct 20, 2022
Merged

feat: Adds a Content Security Policy (CSP) check for production environments #21874

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b156fb6
feat: Adds a Content Security Policy (CSP) check for production envir…
michael-s-molina Oct 18, 2022
357db14
Fix config.py
michael-s-molina Oct 19, 2022
a9cf42e
Adds CSP docs
michael-s-molina Oct 19, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions superset/config.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1223,6 +1223,9 @@ def EMAIL_HEADER_MUTATOR( # pylint: disable=invalid-name,unused-argument
# one here.
TEST_DATABASE_CONNECTION_TIMEOUT = timedelta(seconds=30)

# Enable/disable CSP warning
CONTENT_SECURITY_POLICY_WARNING = True

# Do you want Talisman enabled?
TALISMAN_ENABLED = False
# If you want Talisman, how do you want it configured??
Expand Down
22 changes: 20 additions & 2 deletions superset/initialization/__init__.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -575,8 +575,26 @@ def __call__(
# Flask-Compress
Compress(self.superset_app)

if self.config["TALISMAN_ENABLED"]:
talisman.init_app(self.superset_app, **self.config["TALISMAN_CONFIG"])
show_csp_warning = False
if (
self.config["CONTENT_SECURITY_POLICY_WARNING"]
and not self.superset_app.debug
):
if self.config["TALISMAN_ENABLED"]:
talisman.init_app(self.superset_app, **self.config["TALISMAN_CONFIG"])
if not self.config["TALISMAN_CONFIG"].get("content_security_policy"):
show_csp_warning = True
else:
show_csp_warning = True

if show_csp_warning:
logger.warning(
"We haven't found any Content Security Policy (CSP) defined in the configurations. "
"Please make sure to configure CSP using the TALISMAN_CONFIG key or any other external software. "
"Failing to configure CSP have serious security implications. "
"Check https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP for more information. "
"You can disable this warning using the CONTENT_SECURITY_POLICY_WARNING key."
)

def configure_logging(self) -> None:
self.config["LOGGING_CONFIGURATOR"].configure_logging(
Expand Down