Integrity protection for third-party JavaScript
- 1. <script src=”https://ajax. googleapis.com/ajax/libs/j query/1.8.0/jquery.min.js” integrity=”type:text/javas cript sha512-AODL7idgffQeN sYdTzut09nz9AINcjhj4jHD72H cLirsidbC8tz+dof7gceOCQD8W skeuRFfJ9CsgZTHlMiOYg==”>< /script> Integrity protection for 3rd -party JavaScript François Marier @fmarier mozilla
- 3. Web Platform
- 4. Web Platform
- 6. Content Security Policy aka CSP
- 7. Content Security Policy aka CSP mechanism for preventing XSS
- 8. telling the browser what external content is allowed to load
- 9. what does CSP look like?
- 10. $ curl --head https://mega.nz HTTP/1.1 200 OK Content-Type: text/html Content-Length: 1989 Content-Security-Policy: default-src 'self' *.mega.co.nz *.mega.nz http://*.mega.co.nz http://*.mega.nz; script-src 'self' mega.co.nz mega.nz data: blob:; style-src 'self' 'unsafe-inline' *.mega.co.nz *.mega.nz data: blob:; frame-src 'self' mega:; img-src 'self' *.mega.co.nz *.mega.nz data: blob:
- 11. Hi you<script> alert('p0wned'); </script>! Tweet! What's on your mind?
- 12. (of course, in a real web application, this would never be a problem)
- 13. (the JS would be filtered out during input sanitisation)
- 14. without CSP
- 15. Hi you! Freedom Fighter @whaledumper - just moments ago p0wned Ok
- 16. with CSP
- 17. Hi you! Freedom Fighter @whaledumper - just moments ago
- 19. inline scripts are blocked unless unsafe-inline is specified
- 22. $ curl --head https://twitter.com HTTP/1.1 200 OK content-length: 58347 content-security-policy: … report-uri https://twitter.com/csp_report violation reports:
- 23. "csp-report": { "document-uri": "http://example.org/page.html", "referrer": "http://evil.example.com/haxor.html", "blocked-uri": "http://evil.example.com/image.png", "violated-directive": "default-src 'self'", "effective-directive": "img-src", "original-policy": "default-src 'self'; report-uri http://example.org/..." }
- 26. support for inline scripts Content-Security-Policy: script-src 'sha256-YWIzOW...'
- 29. HTTP Strict Transport Security aka HSTS
- 30. HTTP Strict Transport Security aka HSTS mechanism for preventing HTTPS to HTTP downgrades
- 31. telling the browser that your site should never be reached over HTTP
- 33. GET asb.co.nz 301→ GET https://asb.co.nz 200→ no HSTS, no sslstrip
- 34. GET asb.co.nz → 200 no HSTS, with sslstrip
- 35. what does HSTS look like?
- 36. $ curl -i https://login.xero.com HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Strict-Transport-Security: max-age=31536000 X-Frame-Options: SAMEORIGIN
- 37. with HSTS, with sslstrip GET https://asb.co.nz 200→
- 38. silent client-side redirects HTTP → HTTPS
- 39. no HTTP traffic for sslstrip to tamper with
- 40. except for the very first connection
- 42. pop quiz! how many .nz sites are on the preload list?
- 43. $ grep .nz force-https.json { "name": "mega.co.nz" }, { "name": "api.mega.co.nz" },
- 49. 2015?
- 50. no need to add any extra headers
- 56. how common is this?
- 58. what would happen if that server were compromised?
- 60. Bad Things™ steal sessions leak confidential data redirect to phishing sites enlist DDoS zombies
- 61. simple solution
- 64. You owe me $10.00. f4243c12541be6f79c73e539c426e07a f2f6c4ef8794894f4903aee54542586d
- 65. You owe me $1000. 1ebd7a8d15a6dab743f0c4d147f731bc fc6b74752afe43afa5389ba8830a2215
- 66. guarantee: script won't change or it'll be blocked
- 67. limitation: won't work for scripts that change all the time
- 68. 3 types of scripts
- 69. dynamically-generated script: not a good fit for SRI
- 71. immutable scripts: perfect for SRI
- 72. what about your own scripts? (they change, but you're the one changing them)
- 73. scripts under your control: good fit for SRI
- 74. can usually add the hashing to your static resource pipeline
- 75. #!/bin/sh cat src/*.js > bundle.js HASH=`sha256sum bundle.js |cut -f1 -d' '` mv bundle.js public/bundle-${HASH}.js
- 77. <script src=”widgets.js”> <script src=”app.js”> <script src=”menu.js”>
- 80. what else?
- 88. cat file.js | openssl dgst -sha256 -binary | openssl enc -base64 -A
- 89. SRIhash.org
- 91. status?
- 92. spec is approaching “last call”
- 94. © 2015 François Marier <francois@mozilla.com> This work is licensed under a Creative Commons Attribution-ShareAlike 4.0 License. Questions? feedback: francois@mozilla.com mozilla.dev.security public-webappsec@w3.org
- 95. photo credits: bank notes: https://www.flickr.com/photos/epsos/8463683689 web devs: https://www.flickr.com/photos/mbiddulph/238171366 explosion: https://www.flickr.com/photos/-cavin-/2313239884/