oh oh yeah so I'm going to be speaking
in English because I cannot put to words
in technical Russian anymore since i
moved to us so yeah i will be talking
about CSP what is CS pcs P stands for
Canadian staging professionals and like
if you want to make some money and stop
pushing buttons you can oh hey whatever
it's a joke it's just thing is that if
you search for CSP in Google and switch
the images first thing you see is this
logo on about Canadian staging
professionals and this this is some kind
of shady profession where you went where
they teach you how to stage a house when
you sell it so buyers so you attract
more buyers so yeah we are not going to
talk about that CSP we're going to talk
about content security policy so I work
at a company called shade security and
we we we work on a network appliance
which modifies content modifies HTTP
responses that are going to the
browser's from a web server so since we
modify content we need to take care of
CSP if web server is using CSP but
before going there i'll explain what
csps so CSP is a very cool new
technology that mainly fights cross-site
scripting and help with fighting
cross-site scripting you are addressing
attacks it helps to avoid week's content
vulnerabilities and so main problem
exploited by cross-site scripting is
that browsers cannot distinguish between
screeds that intended to be part of your
web application and scripts that be
maliciously injected by third party so
what CSP is doing CSP is actually
allowing to disable certain features in
the browsers for example by default when
your web page has loads the script from
say jquery com like you don't
have control over it right you you just
have a HTML which says script source
equals HTTP whatever jQuery com so you
cannot that capability of loading that
third-party script is there and there is
no way to disable it so CSP provides a
mechanism to disable certain certain
features just really like brief history
so it was first introduced in 2009 and
so it's six years but it's not really
popular and play you see on next slide
why it's not popular but yeah it was
introducing to say 2009 CSP level one
speck was out in 2012 now CSP to level
to his current standard and there's
active work being done on CSP level 3 so
most modern browsers this is for CSP a
level 1 so basically a every browser
supports the SP level one except Opera
Mini and CSP level 2 is supported by
chrome and firefox only for now but
other browsers are catching up and
adoption among website so we scanned
alexa top hundred thousand websites
landing pages only and only 0.2 percent
are using CSP which is kind of strange
and many of these policies many of
content security policies are
nonsensical or even broken and basically
we decided to understand like why
adoption is so slow and like what can we
do to make it faster and like how can we
help people so ok now the actual
explanation wat CSP is so it is a string
that's that can be delivered either
through HTTP header or as a meta tag on
your page and basically it's a
discounted security policy header and it
consists of directives and source with
with directive so for example to limit
where your webpage can load streets you
just save screech source and you can
have one or more expressions that can be
like scheme source hot sauce or like
keyword source and basically for example
these page says that these policy says
that I want to load scripts only from
HTTPS schemes and or only from example
com or only from myself what happens if
you have multiple expressions so
basically a spec is saying that you have
too much at least one source expression
to to to match script that you want to
load and like for example if you have a
policy that served from a site com and
your web page has a script that's being
loaded from site com it will load
because it exactly match itself so the
source of the script that we're testing
it's exactly the same as the origin from
where are the policies delivered which
is side that comes so the script will
load API that side come wouldn't load
because it doesn't match anything it
doesn't match itself it doesn't match
HTTPS and it doesn't match start at
example.com or HTTPS google that cam
will load because it matches the scheme
it matches one of the conditions like
HTTPS is ok HTTP example that can also
wouldn't work because policy actually
says that domain name should end with
that example that comment we don't have
that condition the condition is not
satisfied and like a TI example that
come with war because even if it's even
it's over an insecure scheme HTTP but
API that example.com matches start
example.com like this one will also work
now matching
so if you have a policy that says script
https what would happen with these three
scripts so obviously like first two
would work because they match https
scheme and like a web socket for example
wouldn't work they just like I'm trying
to explain like basics of matching of a
source expression matching say street
says script source as a only allow
scripts from a comm from domain that
matches a dot-com so what would happen
here I'm sorry first one is actually
incorrect it should it should work sorry
yeah a comm port 8080 wouldn't work
because because if scheme is not
specified I have a slide about it but
basically port in the second source a
second directive assumes that port is
default port for either HTTP or HTTPS so
it will match on the port 80 and 443
with according with corresponding
schemes this one is important so if you
have a past part in your source
expression and it doesn't end with a
forward slash that means there has to be
exact match so you're literally means
that there must be exact match so
basically a that comes fledgeby would
work and anything else wouldn't work
because there is no exact match and if
your path ends with / that means
anything that contains that path and
domain name would work so basically yeah
a dot-com that bead wouldn't work
because there is no exact match but
anything that that contains a that come
/ be / good match basically yeah that's
the rules and it's not really clear from
the spec types of resources that you can
restrict with content security policy
it's like script style images for
mounts form action is where your form
submission can go and like child sources
is for like all the child's like
basically the frames frame source is
obsolete directive and it's going to go
it's going to disappear in CSP level
three and it's replaced by child
actually object is for objects connect
is where your xmlhttprequest or like web
sockets can connect to a media and base
and sort of self-explanatory these are
directives that are accepting source
lists as a as like arguments and there
are three other types of directives that
the frame ancestors is basically
replacement for extreme options media
type is you can list what plug in what
mimetypes your web application can can
can contain and report to our eyes will
come back to report view our eyes
basically where your violation the CSP
violation reports are going to be sent
there are four key words in CSP it's we
saw self which is basically itself is
the alias for the origin from where your
content security policy is coming there
is keyword none there's keyword unsafe
inline and I sunsafe eval and last two
are pretty like dangerous and should be
used with great like ocean and here's
some example like for example if you
have script source none and style source
none it basically means that you do not
allow any streets to be any third-party
any external scripts or styles to be
loaded by your web page so basically
none of this HTML elements would work
would be evaluated by the browser
basically it will not load any script
from third party it wouldn't let any in
line screeches like event handlers and
it also doesn't let any string to
JavaScript interpretations basically
evaluation is not
allowed so it's kind of like safe thing
to do like non keyword is safe to use if
that's what you want unsafe inline
basically it's why at least it allow it
makes an exception and it allows an
inline script to appear in your your web
page and basically that means that if
you have street store a good source star
unsafe inline means that you let scripts
to be loaded from anywhere and you also
allow unsafe inline which is basically
power cross-site scripting appear on
your web page so close i sleeping
payloads appear on your web page and
basically that means that it still loads
scripts from any third party it allows
inline scripts as like event handlers
but it doesn't allow eval and to allow
eval you need to actually use unsafe
eval well go faster over this basically
try to avoid using these keywords unsafe
inline and unsafe evil which means you
don't it's better not to have any inline
scripts on your web page to allow in the
first time if you still have to have a
script on your web page inline script or
inline style on your web page you can
like granularly white wisdom either
through specifying a hash of the content
that you want to appear on your web page
for example if you have to have an
onclick handler for example you can
calculate the digest shut 256 for
example digest and you put that value
that you calculated in your actual
content security policy and only inline
script whose digest matches whatever you
declared in your HTTP header in common
security policy would be evaluated
anything else will be just blocked and
it's it's useful when you when you don't
have dynamic content but if you're for
example if you are your webpage is
serving different streets for per user
agent or like / platform you cannot even
you still can have multiple hashes
declared in your content security policy
but it's not a good idea and there's
another mechanism nonce based mechanism
known since number used ones so you
generate a random number and you put
actually a script attribute in your HTML
page saying nonce and equals but random
value and you have the same notes in
your header and if they match browser
would let it work and it doesn't match
it browser just boxing what I wanted to
say with this slide is that there is
default source directive and if you
don't explicitly specify a resource type
directive the value for that for the
directive will be derived from default
source so which means which means if you
don't have for example phone source
declared in your policy the value for
phone source will be derived from
default source and yeah the same thing
for any source type directly now we
learned that if you have multiple source
expressions in one single directive you
have to match any of them like there
must be a match with any of the
expressions to let the resource load to
be loaded so now what if you have say
like your network infrastructure is that
is in such a way that you for example
have a edge devices that add some some
some default content security policy and
then other web servers actual
application web servers are appending
are actually defining content security
policy that's specific to this
particular webpage so technically yeah
you can have multiple content security
policies but there is a caveat that in
this case you actually have to match
every single content security policy
you have in your that you declare to
allow the web page to flow the resource
basically in this case what would it be
like the only matching URL that would
satisfy all three policies would be
something like HTTPS API that
example.com and only in case if self is
also coming from example.com basically
what you you'll see later how does work
and or you can combine actually a
multiple content security policy headers
as a single header with comma separated
values it's it's not CSP think it's like
HTTP think that you can combine any HTTP
header any multiple HTTP headers into
single HTTP header with comma separated
values it's also applicable to CSP and
basically these are two equivalent but
yes unfortunately you don't see much
here but the point of this slide is you
cannot basically if you try to combine
policies by just concatenating them it's
going to be like different policies
because in first case you have to match
a every single source expression and in
case of second policy like it becomes
normal policy and you have to match only
like any of the source expression so
these are different policies they have
different semantics yeah speaking about
semantics as I said like if there is no
explicit declaration of our resource
type directive its value will be derived
from default source so now if we have
for example a Content security policy
that declares every single possible
source type so we have scripts or style
source image pawn child connect object
that means that default source doesn't
have any meaning in this case so ABC is
like not used by buy any of them because
like every single policy is overriding
the value so basically that means that
you can since all of this sub sub
resource directives
are saying that I'm allowing a day that
that only domain origin DS allowed so
basically you can express the same thing
yes by just saying defaults or D and
they have the same semantics but the
grammar is like completely different
right so yeah if non if you skip none
that means that basically empty list of
source expressions is the same as none
and the same thing is with default here
is how spec interprets if you do not
specify the scheme so basically these
three directives are semantically are
semantically equivalent because
example.com if the third one scheme is
missing and spec is like in very long
sentence with like I don't know 1234
with four negations it defines what you
should do if scheme is missing and but
basically what is it saying that default
scheme if it's missing its HTTP and like
this is an example of how spec is not
really like easy to interpret and yeah
if you have a poor if you have a scheme
and missing port then a default port
will be assumed to be there like for
HTTP it's going to be a tht ps4 for
three and web sockets 8443 a spec also
defines gopher but like who is using go
for these days for most permissive
policy like most of the content security
policy 101 blog posts or like tutorials
are saying that most permissive policies
like defaults or star which means that
any source and any resource tab can be
loaded from anywhere but it's actually
not true because even defaults or star
is still not allowing inline scripts or
it doesn't allow data URLs or file
system URLs or blog so basically most
permissive policy is actually this one
that the lower one is the false or star
unsafe in
and safety valve and it's exactly the
same as like not having the policy on
the other hand most restrictive policy
is going to be default source none so
missing nom means like empties
expression source suppression list means
none before such none but since frame
ancestors and like form action and
sandbox are not derived from the default
source you have to explicitly specify
them because by default if you don't
specify say form action it is star
meaning form can be submitted anywhere
or frame ancestors is also start by
default if you don't explicitly
specified in the policy any website can
load your web page you can load your web
page in a frame post source I don't
remember what is this ok so there's one
exception the kinect source is basically
not about voting resources but about
connecting making connections from your
website and connect source is a
responsible two or more to control where
your website can connect to so basically
self and HTTPS served by example com
it's the same rule like any of the
source expression should match so
example that come for example doesn't
match anything scheme doesn't match it
doesn't match itself because because
self is actually https example.com it's
like origin and we're trying to connect
to http so connection will not be
allowed https example that come port
8080 will also not be allowed because it
assumes that if you don't specify the
port then port has to be four 4 3 four
HTTPS schemes on the other end this one
would work because it matches the origin
except it's the same itself so it is
allowed myself this one is also allowed
because 443 like it's the same as not
specifying 443 because default port for
HTTPS is 443 according to content
security policy spec
websocket wouldn't work because we don't
allow web socket by any of the source
expressions the same is with this guy
some GSP examples from real world this
is actually like CSP a little simplified
CSP that served by CNN it's pretty bad
because they're not only allowing
anything from anywhere there for some
reason duplicating the same data because
basically in script swords are saying we
allow scripts to be loaded from
everywhere and from self which is
already nonsensical but on top of that
they allow unsafe eval and unsafe inline
and plus they allow data URI for images
so basically it's better not to have any
policy than to have something like this
another example is it's actually some
Russian website this is the content
security policy it serves its pretty
long and I'm sure it can be like
optimized another like maybe worst
policy ever it's served by armed com
actually they said allow directive name
which is deprecated and allow actually
never made into official CSP spec and it
was just experimental feature for fire
implemented by Firefox and they use
frame ancestors and frame ancestors
directive was introduced by CSP level 2
and for example Safari doesn't know what
frame ancestors is and Safari doesn't
know what allow is because allowed never
made into the spec so this policy served
by arm com is actually like doing
nothing at all some error handling by
browsers and this is pretty big issue
like for example if you have okay any
HTTP header cannot contain non-ascii
characters pretty much like if we
generalize then CSP is not an exception
like you
cannot have known ASCII characters in
CSP and if you put something like
something outside of a ski range
actually browsers behave pretty
differently a chrome will ignore the
entire policy I entire directive and
Firefox will ignore the the particular
token that has a problem and will still
parse the rest of the tokens for example
if you have scripts or self and foo in
case of chrome everything will be
ignored and like scripts from everywhere
we are allowed to be load it and in case
of firefox self will still be enforced
it's actually a bug because spec is
clear on this and spec says that just
ignore the problematic token and keep
the rest keep-keep other source
expressions and firefox to didn't fix it
another box that we like we reported
panel 15 bags on Chrome these two are
actually security bugs they're figs but
they still haven't removed the security
flag from the box so you cannot see it
it's not available to everybody but for
example this is I think it's pretty big
spec is saying that if you have a policy
like this like star that's something
that's something you actually have too
much you are a match URLs that are
ending with that something that's
something but chrome was actually
allowing something that something so
basically chrome was allowing X that y /
file to be loaded although according to
the spec it shouldn't be load it and
it's pretty I think it's it can be a big
source of a problem of problems because
people respect people implement their
policies according to the spec but then
turns out that chrome that browser is
not interpreting the spec the same way
as you are or this one scripts or star
according to the specs shouldn't allow
any data or file system or blob you are
eyes but chrome was actually allowing it
and you can have something like this in
your on your web page like your
cross-site scripting payload can be data
URI and it will perfectly work in
and you would have false sense of
security by thinking that chrome
implemented it properly there is cool
feature in CSP cold CSP reporting so
what happens when you specify a policy
and your browser violates the policy so
basically tries to load the script from
somewhere that you are not whitelisting
actually browser would send a report to
you to specify where reports should go
you put report uri directive in your
policy and you can specify multiple or
like one uri where the report will be
sent and the rule the spec is saying
that report should go to every URL you
list it there actually some browsers
well all browsers except firefox will
actually append the cookie if you if
report uri shares the if we report to
arise but has the same origin as the web
page where policy is enforced and
although spec is defining the format of
the report every browser implements its
own format of the report like for
example you can see that it's exactly
the same violation generated by Firefox
and Chrome and like even by the size of
the paw report you can see that that
they are different so if you are dealing
with reports ESP reporting just not
normalize them before before processing
oops oh sorry report is has limited
types of data that can that browser can
share with the endpoint that collects
the report so if you want to add some
extra data there is no way to extend the
report format CSP reporting format
report format so the only way is to pass
the data as like query string parameters
of your CSP report actually and by the
end of the presentation I there's a link
on a blog post on how Twitter for
example is handling reports and they are
putting session ID in actually in the
CSP report URI so basically they can
tell that this report was generated by
this browser legitimately because
otherwise like every proud like if you
have a vulnerability in your web page
all browsers in the world are will start
sending to CSP reports and you cannot
really distinguish if this report is
legitimate or somebody is just bombing
you with the same post messages or post
HTTP messages that contain something
that looks like CSP report and like it
can be pretty big source of for example
denial of service attacks there is
another good feature that you can
actually you can deploy your policy in
report only mode so basically report
only header it acts acts exactly the
same way as content security policy
header but it instead of it evaluates
the your policy it evaluates it applies
the it evaluates the violations but it
doesn't enforce the violations it just
generates the report it will generate
reports in the same way but it doesn't
break the page if you have a problem on
the web page with CSP and you mistakenly
are blocking some resource that are that
is not supposed to be blocked the
account security policy report only will
help so basically the
practice is to roll out your content
security policy as report only for a
week and like tweak it and fix it until
you stop receiving reports that are not
supposed to be there and you only
receive actual attack reports and then
like week later you switch to actual
content security policy Heather yeah I
should have mentioned this in the
beginning of the presentation but how
why we started looking it at CSP so
company where I work we make a network
appliance which modifies the HTTP
responses we can inject our own script
into the web page or we might modify the
actual scripts that already there and
the web server is using CSP we need to
actually adjust the CSP before
forwarding that HTTP response to the
browser and it's not actually that easy
task it's not like just concatenating or
like I don't know if for example if we
are introducing new origin and like if
our appliance is adding jquery time it's
not like you are appending just jQuery
that come into the to the script source
it's it has its own rules and yeah we
decided to implement a library which
optimizes things like has full-blown
parser with error locations positions
and warning positions and it can answer
questions like the same questions as
browser would ask a browser CSP
implementation would answer sorry it's
used in production so it's pretty well
tested so yeah well what are the
problems that our library is trying to
solve for example when you have to merge
two policies basically there was a
policy served by the web server and now
we want to merge that policy with
something that we want to add that would
be union merging and it's not like just
this example shows it's not just
basically coordination you have to
properly merge merge the values
we can merge in interstate as a we can
measure using intersection strategy also
and this would basically mimic what the
browser would do if you have multiple
policies basically you have to come up
you have two policies now you have to
come up with some third policy that
would satisfy both policies basically so
if you had a and policy that saying
before source a and B and another policy
which has default source none so non
would win because the only URL that
would match both policies would be like
there is no such URL so for example
default source would become not for
screed source the first policy is saying
default source a be there is no streets
or switch meaning Street source will
derive from default source which means
for the first policy a script source is
also a B and for the second one it's
star so the intersection of them is
going to be a B and like for everything
else there is no intersection so we just
get rid of it but it's hard to manually
right and like better to use something
like our library for example we also
have this website CSP validated a torque
which uses some features of the library
on the back end and like you can test
and
you can either enter URLs to query
actual content security policies of some
websites or like click that button and
will populate a URL of a website that
actually contains CSP to analyze later
or you can like come up with your own
policies and like test them on the
website and like merge and merge using
Union strategy or intersex intersection
strategy see the virus see the warnings
see nonsensical warnings we will also
also optimize the policy for you and you
can compare if there was actually
optimization to clip the to place or it
was the same and you have actual like
optimal policy there I I just said this
actually our website is also serving the
public accountant security policy and I
think this is an example of good policy
where first you write your website so
you don't have to have inline scripts or
any kind of aligned resources because
its first it's good practice it's good
for caching so you move any scripts that
you have to to external files oh yeah
for example this policy covers
everything like we cover all types of
resources we collect our reports we
allow only resources that we actually
need to load and we are trying to be
like as strict as possible by like you
start with default source none and then
you why at least your resources one by
one so yeah we reported like aaron owed
more than ten bucks to against browsers
we start helping with actual CSP spec by
submitting pull requests which are being
accepted sometimes yeah these are like
good resources where you can learn about
CSP and
and that's pretty much it that's it and
i'll be happy to answer any questions i
understand this is not like covering but
like any CSP related questions would be
great
star
so
but the rule is a spec is saying that
you have to at the URL should match any
of the source expressions so if it
matches either what do you say star so
it's kind of nonsensical because star
always wins because like any URL would
match star so there is no reason to
specify anything other than star kinda
besides is there any limits of the GSP
size spec doesn't talk about it but
browsers actually well Chrome has a
limit on HTTP header so yeah that would
be your limit but spec doesn't define
any limits okay thank you
okay I have a question we've implemented
CSP some time ago and we got rid of
report your eye because we try to avoid
using report you arrive by malware guys
something like we hmm we can't we can't
fully trust the JSON parser we wrote for
you I parser for your parser and we
would like to ask if there any report
you write scripts ready that are quite
good enough that are checked for
vulnerabilities and that we can use sure
so there are two things first for
example there was a bug in Firefox that
existed from August last year till
October this year it was generating CSP
reports for valid completely valid web
pages that contain nonce attribute and
so yeah people were being effects
hammered by CSP report generated by
Firefox so a lot of people just disabled
CSP reporting at least if user agent is
Firefox and to answer your question
there are third-party guys that are
collecting your reports for you and
basically they take the risk of being
hacked it's a CSP it's get sentry calm
it's paid service but they normalize the
report for you and like they provide you
the normalized version of everything
yeah basically they parse the JSON they
take care of everything it's paid
there's another guy which is free
website is CSP reporter that I oh I
think or CSP report that I oh yeah we
use that guy report your i dot io or
report you are either yeah yeah but he
turned us off because too many robots
traffic well yeah
while testing in report on the mode but
I want to review just insert some script
and it runs as an Aurora and some
analysts got this Aurora in his console
for example and you run yeah it like
scream port alert something like that
any success if the if the report
analyzer is written so for that actually
spec is saying that CSP report mime type
content type should be application CSP
report but only chrome implements it all
other browsers just still put a
application that j is less Jason yeah so
when all browsers start doing it
properly and you can tell already from
content type and I okay thank you yeah
yeah unfortunately it's not solved now
and like the only thing is to outsource
it to some guys that are ready to take
the vulnerability risk
cool thank you
you