ESB-1195 Introduce minimal CSP policy for the admin-console

admin-console/src/main/webapp/WEB-INF/apsadmin/jsp/entity/entityFinding.jsp

@@ -209,4 +209,4 @@ http://localhost:8080/PortalExample/do/Entity/search.action?entityManagerName=ja
 
 	</wpsa:subset>
 
-</s:form>
+</s:form>

cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/aps/jsp/widgets/content_viewer_list.jsp

@@ -2,7 +2,7 @@
 <%@ taglib prefix="wp" uri="/aps-core" %>
 <%@ taglib prefix="c" uri="http://java.sun.com/jsp/jstl/core" %>
 
-<wp:headInfo type="JS_EXT" info="http://code.jquery.com/ui/1.10.3/jquery-ui.min.js" />
+<wp:headInfo type="JS_EXT" info="https://code.jquery.com/ui/1.10.3/jquery-ui.min.js" />
 
 <jacms:contentList listName="contentList" titleVar="titleVar"
 	pageLinkVar="pageLinkVar" pageLinkDescriptionVar="pageLinkDescriptionVar" userFilterOptionsVar="userFilterOptionsVar" />

cms-plugin/src/main/webapp/WEB-INF/plugins/jacms/aps/jsp/widgets/inc/userFilter-module-entity-Date.jsp

@@ -43,8 +43,8 @@ jQuery(function($){
 });
 </c:set>
 <wp:headInfo type="JS" info="entando-misc-html5-essentials/modernizr-2.5.3-full.js" />
-<wp:headInfo type="JS_EXT" info="http://code.jquery.com/ui/1.10.0/jquery-ui.min.js" />
-<wp:headInfo type="CSS_EXT" info="http://code.jquery.com/ui/1.10.3/themes/smoothness/jquery-ui.min.css" />
+<wp:headInfo type="JS_EXT" info="https://code.jquery.com/ui/1.10.0/jquery-ui.min.js" />
+<wp:headInfo type="CSS_EXT" info="https://code.jquery.com/ui/1.10.3/themes/smoothness/jquery-ui.min.css" />
 <wp:headInfo type="JS_RAW" info="${js_for_datepicker}" />
 
 <fieldset>

engine/src/main/java/com/agiletec/aps/system/SystemConstants.java

@@ -55,9 +55,13 @@
     public static final String PAR_FILEUPLOAD_MAXSIZE = "fileUploadMaxSize";
 
     public static final String PAR_CSP_ENABLED = "cspEnabled";
-    
+
     public static final String PAR_CSP_HEADER_EXTRA_CONFIG = "cspHeaderExtraConfig";
 
+    public static final String PAR_CSP_BACKOFFICE_CONFIG = "cspBackofficeConfig";
+
+    public static final String PAR_CSP_BACKOFFICE_REPORT_ONLY = "cspBackofficeReportOnly";
+
     /**
      * Nome parametro extra per requestContext: lingua corrente
      */
@@ -317,7 +321,15 @@
     public static final String ENTITY_EVENT_CHANNEL = "core-entity";
 
     public static final String CSP_HEADER_ENABLED = "CSP_HEADER_ENABLED";
+    public static final String CSP_HEADER_PORTAL_EXTRACONFIG = "CSP_HEADER_PORTAL_EXTRACONFIG";
+    /**
+     * @deprecated use {@link #CSP_HEADER_PORTAL_EXTRACONFIG}, which makes it explicit that the
+     * variable configures the portal (front-end) policy; kept for backward compatibility.
+     */
+    @Deprecated
     public static final String CSP_HEADER_EXTRACONFIG = "CSP_HEADER_EXTRACONFIG";
+    public static final String CSP_HEADER_BACKOFFICE_CONFIG = "CSP_HEADER_BACKOFFICE_CONFIG";
+    public static final String CSP_HEADER_BACKOFFICE_REPORT_ONLY = "CSP_HEADER_BACKOFFICE_REPORT_ONLY";
     public static final String ENTANDO_CSRF_PROTECTION = "ENTANDO_CSRF_PROTECTION";
     public static final String ENTANDO_CSRF_ALLOWED_DOMAINS = "ENTANDO_CSRF_ALLOWED_DOMAINS";
     public static final String SEPARATOR_DOMAINS = ",";

engine/src/main/java/org/entando/entando/aps/servlet/StartupListener.java

@@ -45,7 +45,7 @@
     private static final EntLogger LOGGER = EntLogFactory.getSanitizedLogger(StartupListener.class);
 
     @Override
     public void contextInitialized(ServletContextEvent event) {
         long startMs = System.currentTimeMillis();
         ServletContext svCtx = event.getServletContext();
         String msg = this.getClass().getName() + ": INIT " + svCtx.getServletContextName();
@@ -72,9 +72,16 @@
         String cspEnabled = System.getenv(SystemConstants.CSP_HEADER_ENABLED);
         if (StringUtils.isEmpty(cspEnabled) || Boolean.TRUE.toString().equalsIgnoreCase(cspEnabled)) {
             LOGGER.info("Content Security Policy (CSP) header is enabled");
-            String cspExtraConfig = System.getenv(SystemConstants.CSP_HEADER_EXTRACONFIG);
+            String cspExtraConfig = System.getenv(SystemConstants.CSP_HEADER_PORTAL_EXTRACONFIG);
+            if (StringUtils.isEmpty(cspExtraConfig)) {
+                cspExtraConfig = System.getenv(SystemConstants.CSP_HEADER_EXTRACONFIG);
+                if (!StringUtils.isEmpty(cspExtraConfig)) {
+                    LOGGER.warn("The CSP_HEADER_EXTRACONFIG environment variable is deprecated:"
+                            + " use CSP_HEADER_PORTAL_EXTRACONFIG instead");
+                }
+            }
             if (!StringUtils.isEmpty(cspExtraConfig)) {
-                LOGGER.info("Content Security Policy (CSP) extra-config set to: " + cspExtraConfig);
+                LOGGER.info("Content Security Policy (CSP) portal extra-config set to: " + cspExtraConfig);
             }
         } else {
             LOGGER.warn("Content Security Policy (CSP) header is not enabled");

engine/src/main/resources/spring/aps/managers/baseManagersConfig.xml

@@ -118,6 +118,12 @@
                 <entry key="cspEnabled">
                     <value>${csp.header.enabled:true}</value>
                 </entry>
+                <entry key="cspBackofficeConfig">
+                    <value>${csp.header.backoffice.config:default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; connect-src 'self'}</value>
+                </entry>
+                <entry key="cspBackofficeReportOnly">
+                    <value>${csp.header.backoffice.reportOnly:false}</value>
+                </entry>
             </map>
         </property>
         <property name="configDAO" >

keycloak-plugin/src/main/resources/spring/plugins/keycloak/aps/keycloakBaseManagersConfig.xml

@@ -51,6 +51,12 @@
                 <entry key="cspEnabled">
                     <value>${csp.header.enabled:true}</value>
                 </entry>
+                <entry key="cspBackofficeConfig">
+                    <value>${csp.header.backoffice.config:default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; object-src 'none'; base-uri 'self'; frame-ancestors 'self'; form-action 'self'; connect-src 'self'}</value>
+                </entry>
+                <entry key="cspBackofficeReportOnly">
+                    <value>${csp.header.backoffice.reportOnly:false}</value>
+                </entry>
             </map>
         </property>
         <property name="configDAO" >

portal-ui/src/main/java/org/entando/entando/aps/servlet/ControllerServlet.java

@@ -32,7 +32,6 @@
 import java.io.IOException;
 import java.io.Reader;
 import java.io.StringReader;
-import java.security.SecureRandom;
 import java.util.List;
 import jakarta.servlet.ServletContext;
 import jakarta.servlet.ServletException;
@@ -108,15 +107,7 @@ protected RequestContext initRequestContext(HttpServletRequest request,
     }
 
     public String createSecureRandomString() {
-        int leftLimit = 48;
-        int rightLimit = 122;
-        int targetStringLength = 64;
-        SecureRandom rand = new SecureRandom();
-        return rand.ints(leftLimit, rightLimit + 1)
-                .filter(i -> (i <= 57 || i >= 65) && (i <= 90 || i >= 97))
-                .limit(targetStringLength)
-                .collect(StringBuilder::new, StringBuilder::appendCodePoint, StringBuilder::append)
-                .toString();
+        return CspNonceGenerator.createNonce();
     }
 
 	protected int controlRequest(HttpServletRequest request,

portal-ui/src/main/java/org/entando/entando/aps/servlet/CspHeaderFilter.java

@@ -0,0 +1,80 @@
+/*
+ * Copyright 2026-Present Entando Inc. (http://www.entando.com) All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU Lesser General Public License as published by the Free
+ * Software Foundation; either version 2.1 of the License, or (at your option)
+ * any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
+ * details.
+ */
+package org.entando.entando.aps.servlet;
+
+import com.agiletec.aps.system.SystemConstants;
+import com.agiletec.aps.system.services.baseconfig.ConfigInterface;
+import com.agiletec.aps.util.ApsWebApplicationUtils;
+import java.io.IOException;
+import jakarta.servlet.Filter;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.ServletException;
+import jakarta.servlet.ServletRequest;
+import jakarta.servlet.ServletResponse;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.apache.commons.lang3.StringUtils;
+
+/**
+ * Applies the Content-Security-Policy header to back-office requests
+ * (/do/*, /struts/*, /ExtStr2/do/*), which do not route through the
+ * {@link ControllerServlet} and would otherwise get no CSP at all.
+ * <p>
+ * The policy is read from the "cspBackofficeConfig" system parameter and honors
+ * the same "cspEnabled" switch used for the portal. An optional "{nonce}"
+ * placeholder in the policy is replaced with a per-request secure random token,
+ * also exposed as the "cspNonceToken" request attribute for use in JSPs.
+ * When the "cspBackofficeReportOnly" parameter is true, the policy is sent as
+ * Content-Security-Policy-Report-Only, allowing violation monitoring without
+ * enforcement during rollout.
+ */
+public class CspHeaderFilter implements Filter {
+
+    public static final String CSP_HEADER_NAME = "Content-Security-Policy";
+    public static final String CSP_REPORT_ONLY_HEADER_NAME = "Content-Security-Policy-Report-Only";
+    public static final String NONCE_PLACEHOLDER = "{nonce}";
+    public static final String REQUEST_ATTR_CSP_NONCE = "cspNonceToken";
+
+    @Override
+    public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+            throws IOException, ServletException {
+        if (request instanceof HttpServletRequest && response instanceof HttpServletResponse) {
+            this.addCspHeader((HttpServletRequest) request, (HttpServletResponse) response);
+        }
+        chain.doFilter(request, response);
+    }
+
+    protected void addCspHeader(HttpServletRequest request, HttpServletResponse response) {
+        ConfigInterface configManager = this.getConfigManager(request);
+        if (!Boolean.parseBoolean(configManager.getParam(SystemConstants.PAR_CSP_ENABLED))) {
+            return;
+        }
+        String policy = configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_CONFIG);
+        if (StringUtils.isBlank(policy)) {
+            return;
+        }
+        if (policy.contains(NONCE_PLACEHOLDER)) {
+            String nonce = CspNonceGenerator.createNonce();
+            request.setAttribute(REQUEST_ATTR_CSP_NONCE, nonce);
+            policy = policy.replace(NONCE_PLACEHOLDER, nonce);
+        }
+        boolean reportOnly = Boolean.parseBoolean(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_REPORT_ONLY));
+        response.setHeader(reportOnly ? CSP_REPORT_ONLY_HEADER_NAME : CSP_HEADER_NAME, policy);
+    }
+
+    protected ConfigInterface getConfigManager(HttpServletRequest request) {
+        return (ConfigInterface) ApsWebApplicationUtils.getBean(SystemConstants.BASE_CONFIG_MANAGER, request);
+    }
+
+}

portal-ui/src/main/java/org/entando/entando/aps/servlet/CspNonceGenerator.java

@@ -0,0 +1,41 @@
+/*
+ * Copyright 2026-Present Entando Inc. (http://www.entando.com) All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU Lesser General Public License as published by the Free
+ * Software Foundation; either version 2.1 of the License, or (at your option)
+ * any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
+ * details.
+ */
+package org.entando.entando.aps.servlet;
+
+import java.security.SecureRandom;
+
+/**
+ * Generates the per-request secure random tokens used as Content-Security-Policy nonces,
+ * shared between the portal front-controller and the back-office CSP filter.
+ */
+public final class CspNonceGenerator {
+
+    private static final SecureRandom RANDOM = new SecureRandom();
+
+    private CspNonceGenerator() {
+        // utility class
+    }
+
+    public static String createNonce() {
+        int leftLimit = 48;
+        int rightLimit = 122;
+        int targetStringLength = 64;
+        return RANDOM.ints(leftLimit, rightLimit + 1)
+                .filter(i -> (i <= 57 || i >= 65) && (i <= 90 || i >= 97))
+                .limit(targetStringLength)
+                .collect(StringBuilder::new, StringBuilder::appendCodePoint, StringBuilder::append)
+                .toString();
+    }
+
+}

portal-ui/src/main/webapp/WEB-INF/aps/jsp/internalservlet/user/inc/attributes/front_dateAttribute.jsp

@@ -58,6 +58,6 @@
 		});
 	</c:set>
 	<wp:headInfo type="JS" info="entando-misc-html5-essentials/modernizr-2.5.3-full.js" />
-	<wp:headInfo type="JS_EXT" info="http://code.jquery.com/ui/1.12.1/jquery-ui.min.js" />
-	<wp:headInfo type="CSS_EXT" info="http://code.jquery.com/ui/1.12.1/themes/smoothness/jquery-ui.min.css" />
+	<wp:headInfo type="JS_EXT" info="https://code.jquery.com/ui/1.12.1/jquery-ui.min.js" />
+	<wp:headInfo type="CSS_EXT" info="https://code.jquery.com/ui/1.12.1/themes/smoothness/jquery-ui.min.css" />
 	<wp:headInfo type="JS_RAW" info="${js_for_datepicker}" />

portal-ui/src/test/java/org/entando/entando/aps/servlet/CspHeaderFilterTest.java

@@ -0,0 +1,124 @@
+/*
+ * Copyright 2026-Present Entando Inc. (http://www.entando.com) All rights reserved.
+ *
+ * This library is free software; you can redistribute it and/or modify it under
+ * the terms of the GNU Lesser General Public License as published by the Free
+ * Software Foundation; either version 2.1 of the License, or (at your option)
+ * any later version.
+ *
+ * This library is distributed in the hope that it will be useful, but WITHOUT
+ * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
+ * FOR A PARTICULAR PURPOSE. See the GNU Lesser General Public License for more
+ * details.
+ */
+package org.entando.entando.aps.servlet;
+
+import static org.mockito.ArgumentMatchers.anyString;
+import static org.mockito.ArgumentMatchers.eq;
+import static org.mockito.Mockito.never;
+
+import com.agiletec.aps.system.SystemConstants;
+import com.agiletec.aps.system.services.baseconfig.ConfigInterface;
+import jakarta.servlet.FilterChain;
+import jakarta.servlet.http.HttpServletRequest;
+import jakarta.servlet.http.HttpServletResponse;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.ArgumentCaptor;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class CspHeaderFilterTest {
+
+    private static final String POLICY = "default-src 'self'; object-src 'none'";
+
+    @Mock
+    private ConfigInterface configManager;
+
+    @Mock
+    private HttpServletRequest request;
+
+    @Mock
+    private HttpServletResponse response;
+
+    @Mock
+    private FilterChain filterChain;
+
+    private CspHeaderFilter filter;
+
+    @BeforeEach
+    void setUp() {
+        this.filter = new CspHeaderFilter() {
+            @Override
+            protected ConfigInterface getConfigManager(HttpServletRequest request) {
+                return configManager;
+            }
+        };
+    }
+
+    @Test
+    void shouldSetEnforcedHeaderWhenCspIsEnabled() throws Exception {
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_ENABLED)).thenReturn("true");
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_CONFIG)).thenReturn(POLICY);
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_REPORT_ONLY)).thenReturn("false");
+        filter.doFilter(request, response, filterChain);
+        Mockito.verify(response).setHeader(CspHeaderFilter.CSP_HEADER_NAME, POLICY);
+        Mockito.verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void shouldSetReportOnlyHeaderWhenConfigured() throws Exception {
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_ENABLED)).thenReturn("true");
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_CONFIG)).thenReturn(POLICY);
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_REPORT_ONLY)).thenReturn("true");
+        filter.doFilter(request, response, filterChain);
+        Mockito.verify(response).setHeader(CspHeaderFilter.CSP_REPORT_ONLY_HEADER_NAME, POLICY);
+        Mockito.verify(response, never()).setHeader(eq(CspHeaderFilter.CSP_HEADER_NAME), anyString());
+        Mockito.verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void shouldNotSetHeaderWhenCspIsDisabled() throws Exception {
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_ENABLED)).thenReturn("false");
+        filter.doFilter(request, response, filterChain);
+        Mockito.verify(response, never()).setHeader(anyString(), anyString());
+        Mockito.verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void shouldNotSetHeaderWhenPolicyIsBlank() throws Exception {
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_ENABLED)).thenReturn("true");
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_CONFIG)).thenReturn(" ");
+        filter.doFilter(request, response, filterChain);
+        Mockito.verify(response, never()).setHeader(anyString(), anyString());
+        Mockito.verify(filterChain).doFilter(request, response);
+    }
+
+    @Test
+    void shouldReplaceNoncePlaceholderAndExposeRequestAttribute() throws Exception {
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_ENABLED)).thenReturn("true");
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_CONFIG))
+                .thenReturn("script-src 'nonce-{nonce}'; object-src 'none'");
+        Mockito.when(configManager.getParam(SystemConstants.PAR_CSP_BACKOFFICE_REPORT_ONLY)).thenReturn("false");
+        filter.doFilter(request, response, filterChain);
+        ArgumentCaptor<String> nonceCaptor = ArgumentCaptor.forClass(String.class);
+        Mockito.verify(request).setAttribute(eq(CspHeaderFilter.REQUEST_ATTR_CSP_NONCE), nonceCaptor.capture());
+        String nonce = nonceCaptor.getValue();
+        Assertions.assertEquals(64, nonce.length());
+        Mockito.verify(response).setHeader(CspHeaderFilter.CSP_HEADER_NAME,
+                "script-src 'nonce-" + nonce + "'; object-src 'none'");
+    }
+
+    @Test
+    void shouldGenerateDifferentNoncesPerRequest() {
+        String first = CspNonceGenerator.createNonce();
+        String second = CspNonceGenerator.createNonce();
+        Assertions.assertNotEquals(first, second);
+        Assertions.assertTrue(first.matches("[0-9A-Za-z]{64}"));
+    }
+
+}