Add Security Module (Lombiq Technologies: OCORE-91)

src/OrchardCore.Cms.Web/appsettings.json

@@ -56,8 +56,8 @@
     //  "InstancePrefix": "" // Optional prefix allowing a Redis instance to be shared by different applications.
     //},
     //"OrchardCore_Security": {
-    //  "ContentSecurityPolicy": [],
-    //  "PermissionsPolicy": [ "fullscreen=self" ],
+    //  "ContentSecurityPolicy": {},
+    //  "PermissionsPolicy": { fullscreen: "self" },
     //  "ReferrerPolicy": "no-referrer"
     //},
     // See https://docs.orchardcore.net/en/latest/docs/reference/core/Shells/#enable-azure-shells-configuration to configure shell and tenant configuration in Azure Blob Storage.

src/OrchardCore.Modules/OrchardCore.Security/Drivers/SecuritySettingsDisplayDriver.cs

@@ -1,4 +1,3 @@
-using System.Linq;
 using System.Threading.Tasks;
 using Microsoft.AspNetCore.Authorization;
 using Microsoft.AspNetCore.Http;
@@ -50,19 +49,22 @@ public override async Task<IDisplayResult> EditAsync(SecuritySettings settings,
             return Initialize<SecuritySettingsViewModel>("SecurityHeadersSettings_Edit", model =>
             {
                 // Set the settings from configuration when AdminSettings are overriden via ConfigureSecuritySettings()
+                var currentSettings = settings;
                 if (_securitySettings.FromConfiguration)
                 {
-                    settings = _securitySettings;
-                    model.FromAdminSettings = false;
+                    currentSettings = _securitySettings;
                 }
 
-                model.ContentSecurityPolicy = settings.ContentSecurityPolicy;
-                model.ContentSecurityPolicyValues = SecurityHeaderDefaults.ContentSecurityPolicyNames.ToList();
-                model.PermissionsPolicy = settings.PermissionsPolicy;
-                model.PermissionsPolicyValues = SecurityHeaderDefaults.PermissionsPolicyNames.ToList();
-                model.ReferrerPolicy = settings.ReferrerPolicy;
-                model.EnableSandbox = model.ContentSecurityPolicy != null && model.ContentSecurityPolicy.Any(p => p.StartsWith(ContentSecurityPolicyValue.Sandbox));
-                model.UpgradeInsecureRequests = model.ContentSecurityPolicy != null && model.ContentSecurityPolicy.Any(p => p == ContentSecurityPolicyValue.UpgradeInsecureRequests);
+                model.FromConfiguration = currentSettings.FromConfiguration;
+                model.ContentSecurityPolicy = currentSettings.ContentSecurityPolicy;
+                model.PermissionsPolicy = currentSettings.PermissionsPolicy;
+                model.ReferrerPolicy = currentSettings.ReferrerPolicy;
+
+                model.EnableSandbox = currentSettings.ContentSecurityPolicy != null &&
+                    currentSettings.ContentSecurityPolicy.ContainsKey(ContentSecurityPolicyValue.Sandbox);
+
+                model.UpgradeInsecureRequests = currentSettings.ContentSecurityPolicy != null &&
+                    currentSettings.ContentSecurityPolicy.ContainsKey(ContentSecurityPolicyValue.UpgradeInsecureRequests);
             }).Location("Content:2").OnGroup(SettingsGroupId);
         }
 
@@ -83,11 +85,9 @@ public override async Task<IDisplayResult> UpdateAsync(SecuritySettings section,
 
                 PrepareContentSecurityPolicyValues(model);
 
-                model.PermissionsPolicyValues.RemoveAll(p => p.EndsWith(PermissionsPolicyOriginValue.None));
-
                 section.ContentTypeOptions = SecurityHeaderDefaults.ContentTypeOptions;
-                section.ContentSecurityPolicy = model.ContentSecurityPolicyValues.ToArray();
-                section.PermissionsPolicy = model.PermissionsPolicyValues.ToArray();
+                section.ContentSecurityPolicy = model.ContentSecurityPolicy;
+                section.PermissionsPolicy = model.PermissionsPolicy;
                 section.ReferrerPolicy = model.ReferrerPolicy;
 
                 if (context.Updater.ModelState.IsValid)
@@ -101,30 +101,22 @@ public override async Task<IDisplayResult> UpdateAsync(SecuritySettings section,
 
         private static void PrepareContentSecurityPolicyValues(SecuritySettingsViewModel model)
         {
-            var sandboxPolicy = model.ContentSecurityPolicyValues.SingleOrDefault(p => p.StartsWith(ContentSecurityPolicyValue.Sandbox));
-            var hasSandboxPolicyWithoutValues = sandboxPolicy == ContentSecurityPolicyValue.Sandbox;
-            var upgradeInsecureRequestsPolicy = model.ContentSecurityPolicyValues.SingleOrDefault(p => p == ContentSecurityPolicyValue.UpgradeInsecureRequests);
-
-            model.ContentSecurityPolicyValues.RemoveAll(p => SecurityHeaderDefaults.ContentSecurityPolicyNames.Contains(p));
-
-            if (model.EnableSandbox && hasSandboxPolicyWithoutValues)
+            if (!model.EnableSandbox)
             {
-                model.ContentSecurityPolicyValues.Add(ContentSecurityPolicyValue.Sandbox);
+                model.ContentSecurityPolicy.Remove(ContentSecurityPolicyValue.Sandbox);
             }
-
-            if (!model.EnableSandbox && sandboxPolicy != null)
+            else if (!model.ContentSecurityPolicy.TryGetValue(ContentSecurityPolicyValue.Sandbox, out _))
             {
-                model.ContentSecurityPolicyValues.Remove(sandboxPolicy);
+                model.ContentSecurityPolicy[ContentSecurityPolicyValue.Sandbox] = null;
             }
 
-            if (model.UpgradeInsecureRequests)
+            if (!model.UpgradeInsecureRequests)
             {
-                model.ContentSecurityPolicyValues.Add(ContentSecurityPolicyValue.UpgradeInsecureRequests);
+                model.ContentSecurityPolicy.Remove(ContentSecurityPolicyValue.UpgradeInsecureRequests);
             }
-
-            if (!model.UpgradeInsecureRequests && upgradeInsecureRequestsPolicy != null)
+            else
             {
-                model.ContentSecurityPolicyValues.Remove(ContentSecurityPolicyValue.UpgradeInsecureRequests);
+                model.ContentSecurityPolicy[ContentSecurityPolicyValue.UpgradeInsecureRequests] = null;
             }
         }
     }

src/OrchardCore.Modules/OrchardCore.Security/Extensions/OrchardCoreBuilderExtensions.cs

@@ -1,28 +1,21 @@
 using Microsoft.Extensions.Configuration;
 using OrchardCore.Environment.Shell.Configuration;
-using OrchardCore.Security;
 using OrchardCore.Security.Settings;
 
 namespace Microsoft.Extensions.DependencyInjection
 {
     public static class OrchardCoreBuilderExtensions
     {
-        public static OrchardCoreBuilder ConfigureSecuritySettings(this OrchardCoreBuilder builder, bool overrideAdminSettings = true)
+        public static OrchardCoreBuilder ConfigureSecuritySettings(this OrchardCoreBuilder builder)
         {
             builder.ConfigureServices((tenantServices, serviceProvider) =>
             {
                 var configurationSection = serviceProvider.GetRequiredService<IShellConfiguration>().GetSection("OrchardCore_Security");
 
                 tenantServices.PostConfigure<SecuritySettings>(settings =>
                 {
-                    if (!overrideAdminSettings)
-                    {
-                        return;
-                    }
-
-                    // Reset the settings to avoid merging with the current settings values
-                    settings.ContentSecurityPolicy = SecurityHeaderDefaults.ContentSecurityPolicy;
-                    settings.PermissionsPolicy = SecurityHeaderDefaults.PermissionsPolicy;
+                    settings.ContentSecurityPolicy.Clear();
+                    settings.PermissionsPolicy.Clear();
 
                     configurationSection.Bind(settings);
 

src/OrchardCore.Modules/OrchardCore.Security/Options/ContentSecurityPolicyValue.cs

@@ -14,10 +14,10 @@ public class ContentSecurityPolicyValue
 
         public const string FormAction = "form-action";
 
-        public const string FrameSource = "frame-src";
-
         public const string FrameAncestors = "frame-ancestors";
 
+        public const string FrameSource = "frame-src";
+
         public const string ImageSource = "img-src";
 
         public const string ManifestSource = "manifest-src";

src/OrchardCore.Modules/OrchardCore.Security/Options/SecurityHeadersOptions.cs

@@ -1,5 +1,6 @@
 using System;
 using System.Collections.Generic;
+using System.Linq;
 using OrchardCore.Security.Services;
 
 namespace OrchardCore.Security.Options
@@ -27,8 +28,17 @@ public SecurityHeadersOptions()
 
         public IList<IHeaderPolicyProvider> HeaderPolicyProviders { get; set; }
 
-        public SecurityHeadersOptions AddContentSecurityPolicy(string policies)
-            => AddContentSecurityPolicy(policies.Split(SecurityHeaderDefaults.PoliciesSeparator, StringSplitOptions.RemoveEmptyEntries));
+        public SecurityHeadersOptions AddContentSecurityPolicy(Dictionary<string, string> policies)
+        {
+            ContentSecurityPolicy = policies
+                .Where(kvp => kvp.Value != null ||
+                    kvp.Key == ContentSecurityPolicyValue.Sandbox ||
+                    kvp.Key == ContentSecurityPolicyValue.UpgradeInsecureRequests)
+                .Select(kvp => kvp.Key + (kvp.Value != null ? " " + kvp.Value : String.Empty))
+                .ToArray();
+
+            return this;
+        }
 
         public SecurityHeadersOptions AddContentSecurityPolicy(params string[] policies)
         {
@@ -44,12 +54,12 @@ public SecurityHeadersOptions AddContentTypeOptions()
             return this;
         }
 
-        public SecurityHeadersOptions AddPermissionsPolicy(string policies)
-            => AddPermissionsPolicy(policies.Split(SecurityHeaderDefaults.PoliciesSeparator, StringSplitOptions.RemoveEmptyEntries));
-
-        public SecurityHeadersOptions AddPermissionsPolicy(params string[] policies)
+        public SecurityHeadersOptions AddPermissionsPolicy(IDictionary<string, string> policies)
         {
-            PermissionsPolicy = policies;
+            PermissionsPolicy = policies
+                .Where(kvp => kvp.Value != PermissionsPolicyOriginValue.None)
+                .Select(kvp => kvp.Key + "=" + kvp.Value)
+                .ToArray();
 
             return this;
         }

src/OrchardCore.Modules/OrchardCore.Security/Services/ContentSecurityPolicyHeaderPolicyProvider.cs

@@ -5,11 +5,21 @@ namespace OrchardCore.Security.Services
 {
     public class ContentSecurityPolicyHeaderPolicyProvider : HeaderPolicyProvider
     {
-        public override void ApplyPolicy(HttpContext httpContext)
+        private string _policy;
+
+        public override void InitializePolicy()
         {
             if (Options.ContentSecurityPolicy.Length > 0)
             {
-                httpContext.Response.Headers[SecurityHeaderNames.ContentSecurityPolicy] = String.Join(SecurityHeaderDefaults.PoliciesSeparator, Options.ContentSecurityPolicy);
+                _policy = String.Join(SecurityHeaderDefaults.PoliciesSeparator, Options.ContentSecurityPolicy);
+            }
+        }
+
+        public override void ApplyPolicy(HttpContext httpContext)
+        {
+            if (_policy != null)
+            {
+                httpContext.Response.Headers[SecurityHeaderNames.ContentSecurityPolicy] = _policy;
             }
         }
     }

src/OrchardCore.Modules/OrchardCore.Security/Services/HeaderPolicyProvider.cs

@@ -7,6 +7,11 @@ public abstract class HeaderPolicyProvider : IHeaderPolicyProvider
     {
         public SecurityHeadersOptions Options { get; set; }
 
+        public virtual void InitializePolicy()
+        {
+
+        }
+
         public abstract void ApplyPolicy(HttpContext httpContext);
     }
 }

src/OrchardCore.Modules/OrchardCore.Security/Services/IHeaderPolicyProvider.cs

@@ -4,6 +4,8 @@ namespace OrchardCore.Security.Services
 {
     public interface IHeaderPolicyProvider
     {
+        void InitializePolicy();
+
         void ApplyPolicy(HttpContext httpContext);
     }
 }

src/OrchardCore.Modules/OrchardCore.Security/Services/PermissionsHeaderPolicyProvider.cs

@@ -5,11 +5,21 @@ namespace OrchardCore.Security.Services
 {
     public class PermissionsHeaderPolicyProvider : HeaderPolicyProvider
     {
-        public override void ApplyPolicy(HttpContext httpContext)
+        private string _policy;
+
+        public override void InitializePolicy()
         {
             if (Options.PermissionsPolicy.Length > 0)
             {
-                httpContext.Response.Headers[SecurityHeaderNames.PermissionsPolicy] = String.Join(SecurityHeaderDefaults.PoliciesSeparator, Options.PermissionsPolicy);
+                _policy = String.Join(SecurityHeaderDefaults.PoliciesSeparator, Options.PermissionsPolicy);
+            }
+        }
+
+        public override void ApplyPolicy(HttpContext httpContext)
+        {
+            if (_policy != null)
+            {
+                httpContext.Response.Headers[SecurityHeaderNames.PermissionsPolicy] = _policy;
             }
         }
     }

src/OrchardCore.Modules/OrchardCore.Security/Services/SecurityHeadersMiddleware.cs

@@ -13,6 +13,11 @@ public SecurityHeadersMiddleware(SecurityHeadersOptions options, RequestDelegate
         {
             _options = options;
             _next = next;
+
+            foreach (var provider in _options.HeaderPolicyProviders)
+            {
+                provider.InitializePolicy();
+            }
         }
 
         public Task Invoke(HttpContext context)

src/OrchardCore.Modules/OrchardCore.Security/Settings/SecuritySettings.cs

@@ -1,12 +1,56 @@
+using System.Collections.Generic;
+using System.Linq;
+using OrchardCore.Security.Options;
+
 namespace OrchardCore.Security.Settings
 {
     public class SecuritySettings
     {
-        public string[] ContentSecurityPolicy { get; set; } = SecurityHeaderDefaults.ContentSecurityPolicy;
+        private Dictionary<string, string> _contentSecurityPolicy = new();
+        private Dictionary<string, string> _permissionsPolicy = new();
+
+        public Dictionary<string, string> ContentSecurityPolicy
+        {
+            get => _contentSecurityPolicy;
+            set
+            {
+                if (value == null)
+                {
+                    return;
+                }
+
+                // Exclude null values and clone the dictionary to not be shared by site settings and options instances.
+                _contentSecurityPolicy = value
+                    .Where(kvp => kvp.Value != null ||
+                        kvp.Key == ContentSecurityPolicyValue.Sandbox ||
+                        kvp.Key == ContentSecurityPolicyValue.UpgradeInsecureRequests)
+                    .ToDictionary(kvp => kvp.Key, kvp => kvp.Value);
+
+                if (_contentSecurityPolicy.TryGetValue(ContentSecurityPolicyValue.UpgradeInsecureRequests, out _))
+                {
+                    _contentSecurityPolicy[ContentSecurityPolicyValue.UpgradeInsecureRequests] = null;
+                }
+            }
+        }
 
         public string ContentTypeOptions { get; set; } = SecurityHeaderDefaults.ContentTypeOptions;
 
-        public string[] PermissionsPolicy { get; set; } = SecurityHeaderDefaults.PermissionsPolicy;
+        public Dictionary<string, string> PermissionsPolicy
+        {
+            get => _permissionsPolicy;
+            set
+            {
+                if (value == null)
+                {
+                    return;
+                }
+
+                // Exlude 'None' values and clone the dictionary to not be shared by site settings and options instances.
+                _permissionsPolicy = value
+                    .Where(kvp => kvp.Value != PermissionsPolicyOriginValue.None)
+                    .ToDictionary(kvp => kvp.Key, kvp => kvp.Value);
+            }
+        }
 
         public string ReferrerPolicy { get; set; } = SecurityHeaderDefaults.ReferrerPolicy;
 

src/OrchardCore.Modules/OrchardCore.Security/ViewModels/SecuritySettingsViewModel.cs

@@ -1,25 +1,50 @@
 using System.Collections.Generic;
+using System.Linq;
 using Microsoft.AspNetCore.Mvc.ModelBinding;
+using OrchardCore.Security.Options;
 
 namespace OrchardCore.Security.ViewModels
 {
     public class SecuritySettingsViewModel
     {
-        public string[] ContentSecurityPolicy { get; set; }
-
-        public List<string> ContentSecurityPolicyValues { get; set; }
+        private Dictionary<string, string> _contentSecurityPolicy = new();
+        private Dictionary<string, string> _permissionsPolicy = new();
+
+        public Dictionary<string, string> ContentSecurityPolicy
+        {
+            get => _contentSecurityPolicy;
+            set
+            {
+                // Populate all policy values for the editor (null if not provided).
+                _contentSecurityPolicy = SecurityHeaderDefaults.ContentSecurityPolicyNames
+                    .ToDictionary(name => name, name =>
+                        value?.ContainsKey(name) ?? false
+                            ? value[name]
+                            : null);
+            }
+        }
 
         public bool EnableSandbox { get; set; }
 
         public bool UpgradeInsecureRequests { get; set; }
 
-        public string[] PermissionsPolicy { get; set; }
-
-        public List<string> PermissionsPolicyValues { get; set; }
+        public Dictionary<string, string> PermissionsPolicy
+        {
+            get => _permissionsPolicy;
+            set
+            {
+                // Populate all policy values for the editor ('None' if not provided).
+                _permissionsPolicy = SecurityHeaderDefaults.PermissionsPolicyNames
+                    .ToDictionary(name => name, name =>
+                        value?.ContainsKey(name) ?? false
+                            ? value[name]
+                            : PermissionsPolicyOriginValue.None);
+            }
+        }
 
         public string ReferrerPolicy { get; set; }
 
         [BindNever]
-        public bool FromAdminSettings { get; set; } = true;
+        public bool FromConfiguration { get; set; }
     }
 }