TDEAL-16: Security improvements

Lombiq.HelpfulLibraries.AspNetCore/Docs/Security.md

@@ -0,0 +1,11 @@
+# Lombiq Helpful Libraries - ASP.NET Core Libraries - Security
+
+## `Content-Security-Policy`
+
+- `ApplicationBuilderExtensions`: Contains the `AddContentSecurityPolicyHeader` extension method to add a middleware that provides the `Content-Security-Policy` header.
+- `CdnContentSecurityPolicyProvider`: An optional policy provider that permits additional CDN host names for the `script-scr` and `style-src` directives.
+- `ContentSecurityPolicyDirectives`: The `Content-Security-Policy` directive names that are defined in the W3C [recommendation](https://www.w3.org/TR/CSP2/#directives) and some common values.
+- `IContentSecurityPolicyProvider`: Interface for services that update the dictionary that will be turned into the `Content-Security-Policy` header value.
+- `ServiceCollectionExtensions`: Extensions methods for `IServiceCollection`, e.g. `AddContentSecurityPolicyProvider()` is a shortcut to register `IContentSecurityPolicyProvider` in dependency injection.
+
+There is a similar section for security extensions related to Orchard Core [here](../../Lombiq.HelpfulLibraries.OrchardCore/Docs/Security.md).

Lombiq.HelpfulLibraries.AspNetCore/Extensions/CookieHttpContextExtensions .cs

@@ -7,12 +7,13 @@ public static class CookieHttpContextExtensions
     /// <summary>
     /// Sets the cookie with the given name with a maximal expiration time.
     /// </summary>
-    public static void SetCookieForever(this HttpContext httpContext, string name, string value) =>
+    public static void SetCookieForever(this HttpContext httpContext, string name, string value, SameSiteMode sameSite = SameSiteMode.Lax) =>
         httpContext.Response.Cookies.Append(name, value, new CookieOptions
         {
             Expires = DateTimeOffset.MaxValue,
             Secure = true,
             HttpOnly = true,
+            SameSite = sameSite,
         });
 
     /// <summary>

Lombiq.HelpfulLibraries.AspNetCore/Readme.md

@@ -14,3 +14,4 @@ Please see the inline documentation of each piece of the API to learn more.
 - [Localization](Docs/Localization.md)
 - [Middlewares](Docs/Middlewares.md)
 - [MVC](Docs/Mvc.md)
+- [Security](Docs/Security.md)

Lombiq.HelpfulLibraries.AspNetCore/Security/ApplicationBuilderExtensions.cs

@@ -0,0 +1,95 @@
+using Lombiq.HelpfulLibraries.AspNetCore.Security;
+using Microsoft.Extensions.DependencyInjection;
+using System;
+using System.Collections.Generic;
+using static Lombiq.HelpfulLibraries.AspNetCore.Security.ContentSecurityPolicyDirectives;
+using static Lombiq.HelpfulLibraries.AspNetCore.Security.ContentSecurityPolicyDirectives.CommonValues;
+
+namespace Microsoft.AspNetCore.Builder;
+
+public static class ApplicationBuilderExtensions
+{
+    /// <summary>
+    /// Adds a middleware that supplies the <c>Content-Security-Policy</c> header. It may be further expanded by
+    /// registering services that implement <see cref="IContentSecurityPolicyProvider"/>.
+    /// </summary>
+    /// <param name="allowInlineScript">
+    /// If <see langword="true"/> then inline scripts are permitted. When using Orchard Core a lot of front end shapes
+    /// use inline script blocks without a nonce (see https://github.com/OrchardCMS/OrchardCore/issues/13389) making
+    /// this a required setting.
+    /// </param>
+    /// <param name="allowInlineStyle">
+    /// If <see langword="true"/> then inline styles are permitted. Note that even if your site has no embedded style
+    /// blocks and no style attributes, some Javascript libraries may still create some from code.
+    /// </param>
+    public static IApplicationBuilder UseContentSecurityPolicyHeader(
+        this IApplicationBuilder app,
+        bool allowInlineScript,
+        bool allowInlineStyle) =>
+        app.Use(async (context, next) =>
+        {
+            const string key = "Content-Security-Policy";
+
+            if (context.Response.Headers.ContainsKey(key))
+            {
+                await next();
+                return;
+            }
+
+            var securityPolicies = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
+            {
+                // Default values enforcing a same origin policy for all resources.
+                [BaseUri] = Self,
+                [DefaultSrc] = Self,
+                [FrameSrc] = Self,
+                [ScriptSrc] = Self,
+                [StyleSrc] = Self,
+                [FormAction] = Self,
+                // Needed for SVG images using "data:image/svg+xml,..." data URLs.
+                [ImgSrc] = $"{Self} {Data}",
+                // Modern sites shouldn't need <object>, <embed>, and <applet> elements.
+                [ObjectSrc] = None,
+                // Necessary to prevent clickjacking (https://developer.mozilla.org/en-US/docs/Glossary/Clickjacking).
+                [FrameAncestors] = Self,
+            };
+
+            if (allowInlineScript) securityPolicies[ScriptSrc] = $"{Self} {UnsafeInline}";
+            if (allowInlineStyle) securityPolicies[StyleSrc] = $"{Self} {UnsafeInline}";
+
+            await next();
+
+            // The thought behind this provider model is that if you need something else than the default, you should
+            // add a provider that only applies the additional directive on screens where it's actually needed. This way
+            // we  maintain minimal permissions. If you need additional
+            foreach (var provider in context.RequestServices.GetService<IEnumerable<IContentSecurityPolicyProvider>>())
+            {
+                await provider.UpdateAsync(securityPolicies, context);
+            }
+
+            var policy = string.Join("; ", securityPolicies.Select((key, value) => $"{key} {value}"));
+            context.Response.Headers.Add(key, policy);
+        });
+
+    /// <summary>
+    /// Adds a middleware that sets the <c>X-Content-Type-Options</c> header to <c>nosniff</c>.
+    /// </summary>
+    /// <remarks><para>
+    /// "The Anti-MIME-Sniffing header X-Content-Type-Options was not set to ’nosniff’. This allows older versions of
+    /// Internet Explorer and Chrome to perform MIME-sniffing on the response body, potentially causing the response
+    /// body to be interpreted  and displayed as a content type other than the declared content type. Current (early
+    /// 2014) and legacy versions  of Firefox will use the declared content type (if one is set), rather than performing
+    /// MIME-sniffing." As written in <a href="https://www.zaproxy.org/docs/alerts/10021/">the documentation</a>.
+    /// </para></remarks>
+    public static IApplicationBuilder UseNosniffContentTypeOptionsHeader(this IApplicationBuilder app) =>
+        app.Use(async (context, next) =>
+        {
+            const string key = "X-Content-Type-Options";
+
+            if (!context.Response.Headers.ContainsKey(key))
+            {
+                context.Response.Headers.Add(key, "nosniff");
+            }
+
+            await next();
+        });
+}

Lombiq.HelpfulLibraries.AspNetCore/Security/CdnContentSecurityPolicyProvider.cs

@@ -0,0 +1,52 @@
+using Microsoft.AspNetCore.Http;
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+using static Lombiq.HelpfulLibraries.AspNetCore.Security.ContentSecurityPolicyDirectives;
+
+namespace Lombiq.HelpfulLibraries.AspNetCore.Security;
+
+/// <summary>
+/// A content security policy directive provider that provides additional permitted host names for <see
+/// cref="StyleSrc"/> and <see cref="ScriptSrc"/>.
+/// </summary>
+public class CdnContentSecurityPolicyProvider : IContentSecurityPolicyProvider
+{
+    // These may be amended during program setup.
+#pragma warning disable CA2227 // CA2227: Change 'PermittedStyleSources' to be read-only by removing the property setter
+    /// <summary>
+    /// Gets or sets the URLs whose <see cref="Uri.Host"/> will be added to the <see cref="StyleSrc"/> directive.
+    /// </summary>
+    public static ICollection<Uri> PermittedStyleSources { get; set; } = new[]
+    {
+        new Uri("https://fonts.googleapis.com/css"),
+        new Uri("https://fonts.gstatic.com/"),
+        new Uri("https://cdn.jsdelivr.net/npm"),
+    };
+
+    /// <summary>
+    /// Gets or sets the URLs whose <see cref="Uri.Host"/> will be added to the <see cref="ScriptSrc"/> directive.
+    /// </summary>
+    public static ICollection<Uri> PermittedScriptSources { get; set; } = new[]
+    {
+        new Uri("https://cdn.jsdelivr.net/npm"),
+    };
+#pragma warning restore CA2227 // CA2227: Change 'PermittedStyleSources' to be read-only by removing the property setter
+
+    public ValueTask UpdateAsync(IDictionary<string, string> securityPolicies, HttpContext context)
+    {
+        if (PermittedStyleSources.Any())
+        {
+            securityPolicies[StyleSrc] += " " + string.Join(' ', PermittedStyleSources.Select(uri => uri.Host));
+        }
+
+        if (PermittedScriptSources.Any())
+        {
+            securityPolicies[ScriptSrc] += " " + string.Join(' ', PermittedScriptSources.Select(uri => uri.Host));
+        }
+
+        return ValueTask.CompletedTask;
+    }
+}

Lombiq.HelpfulLibraries.AspNetCore/Security/ContentSecurityPolicyDirectives.cs

@@ -0,0 +1,38 @@
+namespace Lombiq.HelpfulLibraries.AspNetCore.Security;
+
+/// <summary>
+/// The <c>Content-Security-Policy</c> directives defined in the <a href="https://www.w3.org/TR/CSP2/#directives">W3C
+/// Recommendation</a>.
+/// </summary>
+public static class ContentSecurityPolicyDirectives
+{
+    public const string BaseUri = "base-uri";
+    public const string ChildSrc = "child-src";
+    public const string ConnectSrc = "connect-src";
+    public const string DefaultSrc = "default-src";
+    public const string FontSrc = "font-src";
+    public const string FormAction = "form-action";
+    public const string FrameAncestors = "frame-ancestors";
+    public const string FrameSrc = "frame-src";
+    public const string ImgSrc = "img-src";
+    public const string MediaSrc = "media-src";
+    public const string ObjectSrc = "object-src";
+    public const string PluginTypes = "plugin-types";
+    public const string ReportUri = "report-uri";
+    public const string Sandbox = "sandbox";
+    public const string ScriptSrc = "script-src";
+    public const string StyleSrc = "style-src";
+
+    public static class CommonValues
+    {
+        // These values represent special words so they must be surrounded with apostrophes.
+        public const string Self = "'self'";
+        public const string None = "'none'";
+        public const string UnsafeInline = "'unsafe-inline'";
+        public const string UnsafeEval = "'unsafe-eval'";
+
+        // These values represent allowed protocol schemes.
+        public const string Https = "https:";
+        public const string Data = "data:";
+    }
+}

Lombiq.HelpfulLibraries.AspNetCore/Security/IContentSecurityPolicyProvider.cs

@@ -0,0 +1,19 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+using System.Collections.Generic;
+using System.Threading.Tasks;
+
+namespace Lombiq.HelpfulLibraries.AspNetCore.Security;
+
+/// <summary>
+/// A service for updating the dictionary that will be turned into the <c>Content-Security-Policy</c> header value by
+/// <see cref="ApplicationBuilderExtensions.UseContentSecurityPolicyHeader"/>.
+/// </summary>
+public interface IContentSecurityPolicyProvider
+{
+    /// <summary>
+    /// Updates the <paramref name="securityPolicies"/> dictionary where the keys are the <c>Content-Security-Policy</c>
+    /// directives names and the values are the matching directive values.
+    /// </summary>
+    public ValueTask UpdateAsync(IDictionary<string, string> securityPolicies, HttpContext context);
+}

Lombiq.HelpfulLibraries.AspNetCore/Security/ServiceCollectionExtensions.cs

@@ -0,0 +1,23 @@
+using Lombiq.HelpfulLibraries.AspNetCore.Security;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Http;
+
+namespace Microsoft.Extensions.DependencyInjection;
+
+public static class ServiceCollectionExtensions
+{
+    /// <summary>
+    /// Registers a Content Security Policy provider that implements <see cref="IContentSecurityPolicyProvider"/> and
+    /// will be used by <see cref="ApplicationBuilderExtensions.UseContentSecurityPolicyHeader"/>.
+    /// </summary>
+    public static IServiceCollection AddContentSecurityPolicyProvider<TProvider>(this IServiceCollection services)
+        where TProvider : class, IContentSecurityPolicyProvider =>
+        services.AddScoped<IContentSecurityPolicyProvider, TProvider>();
+
+    /// <summary>
+    /// Configures the session cookie to be always secure. With this configuration the token won't work in an HTTP
+    /// environment so make sure that HTTPS redirection is enabled.
+    /// </summary>
+    public static IServiceCollection ConfigureSessionCookieAlwaysSecure(this IServiceCollection services) =>
+        services.Configure<SessionOptions>(options => options.Cookie.SecurePolicy = CookieSecurePolicy.Always);
+}

Lombiq.HelpfulLibraries.OrchardCore/DependencyInjection/InlineStartup.cs

@@ -0,0 +1,43 @@
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Routing;
+using Microsoft.Extensions.DependencyInjection;
+using OrchardCore.Modules;
+using System;
+
+namespace Lombiq.HelpfulLibraries.OrchardCore.DependencyInjection;
+
+/// <summary>
+/// A startup class that invokes the delegates provided in the constructor.
+/// </summary>
+public class InlineStartup : StartupBase
+{
+    private readonly Action<IServiceCollection> _configureServices;
+    private readonly Action<IApplicationBuilder, IEndpointRouteBuilder, IServiceProvider> _configure;
+    private readonly int _order;
+
+    public override int Order => _order;
+
+    public InlineStartup(
+        Action<IServiceCollection> configureServices,
+        Action<IApplicationBuilder> configure,
+        int order = 0)
+        : this(configureServices, (app, _, _) => configure(app), order)
+    {
+    }
+
+    public InlineStartup(
+        Action<IServiceCollection> configureServices,
+        Action<IApplicationBuilder, IEndpointRouteBuilder, IServiceProvider> configure = null,
+        int order = 0)
+    {
+        _configureServices = configureServices;
+        _configure = configure;
+        _order = order;
+    }
+
+    public override void ConfigureServices(IServiceCollection services) =>
+        _configureServices?.Invoke(services);
+
+    public override void Configure(IApplicationBuilder app, IEndpointRouteBuilder routes, IServiceProvider serviceProvider) =>
+        _configure?.Invoke(app, routes, serviceProvider);
+}

Lombiq.HelpfulLibraries.OrchardCore/DependencyInjection/ServiceCollectionExtensions.cs

@@ -1,6 +1,10 @@
 using Lombiq.HelpfulLibraries.Common.DependencyInjection;
+using Microsoft.AspNetCore.Builder;
+using Microsoft.AspNetCore.Routing;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.DependencyInjection.Extensions;
+using OrchardCore.Modules;
+using System;
 
 namespace Lombiq.HelpfulLibraries.OrchardCore.DependencyInjection;
 
@@ -15,4 +19,26 @@ public static void AddOrchardServices(this IServiceCollection services)
         services.AddLazyInjectionSupport();
         services.TryAddTransient(typeof(IOrchardServices<>), typeof(OrchardServices<>));
     }
+
+    /// <summary>
+    /// Creates a new <see cref="InlineStartup"/> instance using the provided parameters, and adds it to the service
+    /// collection.
+    /// </summary>
+    public static IServiceCollection AddInlineStartup(
+        this IServiceCollection services,
+        Action<IServiceCollection> configureServices,
+        Action<IApplicationBuilder, IEndpointRouteBuilder, IServiceProvider> configure,
+        int order = 0) =>
+        services.AddSingleton<IStartup>(new InlineStartup(configureServices, configure, order));
+
+    /// <summary>
+    /// Creates a new <see cref="InlineStartup"/> instance using the provided parameters, and adds it to the service
+    /// collection.
+    /// </summary>
+    public static IServiceCollection AddInlineStartup(
+        this IServiceCollection services,
+        Action<IServiceCollection> configureServices,
+        Action<IApplicationBuilder> configure,
+        int order = 0) =>
+        services.AddSingleton<IStartup>(new InlineStartup(configureServices, configure, order));
 }

Lombiq.HelpfulLibraries.OrchardCore/Docs/Security.md

@@ -0,0 +1,7 @@
+# Lombiq Helpful Libraries - Orchard Core Libraries - Security
+
+## Extensions
+
+- `SecurityOrchardCoreBuilderExtensions`: Adds `BuilderExtensions` extensions. For example, the `ConfigureSecurityDefaults()` that provides some default security configuration for Orchard Core.
+
+There is a similar section for security extensions related to ASP.NET Core [here](../../Lombiq.HelpfulLibraries.AspNetCore/Docs/Security.md).

Lombiq.HelpfulLibraries.OrchardCore/Lombiq.HelpfulLibraries.OrchardCore.csproj

@@ -44,6 +44,7 @@
     <PackageReference Include="OrchardCore.DisplayManagement" Version="1.7.0" />
     <PackageReference Include="OrchardCore.ResourceManagement" Version="1.7.0" />
     <PackageReference Include="OrchardCore.Workflows.Abstractions" Version="1.7.0" />
+    <PackageReference Include="OrchardCore.Setup.Abstractions" Version="1.7.0" />
   </ItemGroup>
 
   <ItemGroup>

Lombiq.HelpfulLibraries.OrchardCore/Readme.md

@@ -20,6 +20,7 @@ For general details about and on using the Helpful Libraries see the [root Readm
 - [Mvc](Docs/Mvc.md)
 - [Navigation](Docs/Navigation.md)
 - [ResourceManagement](Docs/ResourceManagement.md)
+- [Security](Docs/Security.md)
 - [Settings](Docs/Settings.md)
 - [Shapes](Docs/Shapes.md)
 - [TagHelpers](Docs/TagHelpers.md)