Page MenuHomePhabricator

Should foundationwiki's custom (report-only) content-security-policy be removed?
Open, Needs TriagePublic

Description

Wikimedia's CommonSettings.php currently contains the following code, which (IIUC) adds a custom report-only Content Security Policy header to responses that get sent by foundationwiki (https://foundation.wikimedia.org/):

if ( $wgDBname === 'foundationwiki' ) {
	// Foundationwiki has raw html enabled. Attempt to prevent people
	// from accidentally violating the privacy policy with external scripts.
	// Note, we need all WMF domains in here due to Special:HideBanners
	// being loaded as an image from various domains on donation thank you
	// pages.
	$wgHooks['BeforePageDisplay'][] = static function ( $out, $skin ) {
		$resp = $out->getRequest()->response();
		$cspHeader = "default-src *.wikimedia.org *.wikipedia.org *.wiktionary.org *.wikisource.org *.wikibooks.org *.wikiversity.org *.wikiquote.org *.wikinews.org www.mediawiki.org www.wikidata.org *.wikifunctions.org *.wikivoyage.org data: blob: 'self'; script-src *.wikimedia.org 'unsafe-inline' 'unsafe-eval' 'self'; style-src  *.wikimedia.org data: 'unsafe-inline' 'self'; report-uri /w/api.php?action=cspreport&format=none&reportonly=1&source=wmfwiki&";
		$resp->header( "Content-Security-Policy-Report-Only: $cspHeader" );
	};
}

From what I can see, it seems like this was added in March 2017 by https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/341259 ("Add a CSP policy to foundationwiki to prevent privacy breach"), for T159386: Make abusefilter on foundationwiki to prevent people accidentally violating our privacy policy.

The code's comments refer to it being in place due to foundationwiki having raw HTML enabled. However, from what I can see, $wgRawHtml was disabled for foundationwiki in November 2018 by https://gerrit.wikimedia.org/r/c/operations/mediawiki-config/+/462834 (for T201285: Disable raw HTML in https://foundation.wikimedia.org/).

So I guess my question is -- given the above, can this custom config now be safely removed; & if so, should it be?

Event Timeline

  • ccing @Bawolff & @Jdforrester-WMF in case you have any thoughts, as folks involved with the previous two tasks.
  • marking as 'external' from a Wikimedia-Site-requests point-of-view, as I guess that this would probably have to be actioned (or, at least, signed-off by) Wikimedia security folks.

(also FWIW, I guess the Content-Security-Policy-Report-Only header set by this code may currently be being overridden by the one being set by Varnish)

Please do not ping people like this about tasks from a decade ago when there's a vastly different process and owner now.

Okay, apologies. I pinged in case you e.g. had some context that might currently be missing (as folks previously involved, even though the process is probably now different); but obviously feel free to unsubscribe / please don't feel an obligation to say/do anything regarding this task :)

(I probably should have tagged Security-Team on this task to begin with tbh -- as I alluded to in T423691#11833139, I assume that any action/decision here may need to be made/led by WMF security folks.)

I think it probably should be removed. I honestly have no idea what the original intention was here. @Catrope, any strong opinions why we shouldn't remove this?

I think it probably should be removed. I honestly have no idea what the original intention was here. @Catrope, any strong opinions why we shouldn't remove this?

IIRC, I think the idea was that we'd roll out actual CSP to foundationwiki ahead of other wikis, due to the more critical risks and smaller, (and now staff-only) editing community. Nowadays it's probably not worthwhile doing apart.