Let users configure security headers in their Webserver

Doing this in the PHP code is not the right approach for multiple reasons:

1. A bug in the PHP code prevents them from being added to the response.
2. They are only added when something is served via PHP and not in other cases (that makes for example the newest IE UXSS which is not yet patched by Microsoft exploitable on ownCloud)
3. Some headers such as the Strict-Transport-Security might require custom modifications by administrators. This was not possible before and lead to buggy situations.

This pull request moves those headers out of the PHP code and adds a security check to the admin settings performed via JS.

1 files changed, 95 insertions, 1 deletions

diff --git a/core/js/setupchecks.js b/core/js/setupchecks.js
index 00e73162c55..d5bd1c465b2 100644
--- a/core/js/setupchecks.js
+++ b/core/js/setupchecks.js
@@ -70,7 +70,101 @@
 				url: OC.generateUrl('settings/ajax/checksetup')
 			}).then(afterCall, afterCall);
 			return deferred.promise();
+		},
+
+		/**
+		 * Runs generic checks on the server side, the difference to dedicated
+		 * methods is that we use the same XHR object for all checks to save
+		 * requests.
+		 *
+		 * @return $.Deferred object resolved with an array of error messages
+		 */
+		checkGeneric: function() {
+			var self = this;
+			var deferred = $.Deferred();
+			var afterCall = function(data, statusText, xhr) {
+				var messages = [];
+				messages = messages.concat(self._checkSecurityHeaders(xhr));
+				messages = messages.concat(self._checkSSL(xhr));
+				deferred.resolve(messages);
+			};
+
+			$.ajax({
+				type: 'GET',
+				url: OC.generateUrl('heartbeat')
+			}).then(afterCall, afterCall);
+
+			return deferred.promise();
+		},
+
+		/**
+		 * Runs check for some generic security headers on the server side
+		 *
+		 * @param {Object} xhr
+		 * @return {Array} Array with error messages
+		 */
+		_checkSecurityHeaders: function(xhr) {
+			var messages = [];
+
+			if (xhr.status === 200) {
+				var securityHeaders = {
+					'X-XSS-Protection': '1; mode=block',
+					'X-Content-Type-Options': 'nosniff',
+					'X-Robots-Tag': 'none',
+					'X-Frame-Options': 'SAMEORIGIN'
+				};
+
+				for (var header in securityHeaders) {
+					if(xhr.getResponseHeader(header) !== securityHeaders[header]) {
+						messages.push(
+							t('core', 'The "{header}" HTTP header is not configured to equal to "{expected}". This is a potential security risk and we recommend adjusting this setting.', {header: header, expected: securityHeaders[header]})
+						);
+					}
+				}
+			} else {
+				messages.push(t('core', 'Error occurred while checking server setup'));
+			}
+
+			return messages;
+		},
+
+		/**
+		 * Runs check for some SSL configuration issues on the server side
+		 *
+		 * @param {Object} xhr
+		 * @return {Array} Array with error messages
+		 */
+		_checkSSL: function(xhr) {
+			var messages = [];
+
+			if (xhr.status === 200) {
+				if(OC.getProtocol() === 'https') {
+					// Extract the value of 'Strict-Transport-Security'
+					var transportSecurityValidity = xhr.getResponseHeader('Strict-Transport-Security');
+					if(transportSecurityValidity !== null && transportSecurityValidity.length > 8) {
+						var firstComma = transportSecurityValidity.indexOf(";");
+						if(firstComma !== -1) {
+							transportSecurityValidity = transportSecurityValidity.substring(0, firstComma);
+						} else {
+							transportSecurityValidity = transportSecurityValidity.substring(8);
+						}
+					}
+
+					if(isNaN(transportSecurityValidity) || transportSecurityValidity <= 2678399) {
+						messages.push(
+							t('core', 'The "Strict-Transport-Security" HTTP header is not configured to least "2,678,400" seconds. This is a potential security risk and we recommend adjusting this setting.')
+						);
+					}
+				} else {
+					messages.push(
+						t('core', 'You are accessing this site via HTTP. We strongly suggest you configure your server to require using HTTPS instead.')
+					);
+				}
+			} else {
+				messages.push(t('core', 'Error occurred while checking server setup'));
+			}
+
+			return messages;
 		}
 	};
 })();
-