CSP kubapenteste: Gusobanukirwa Ibyingenzi

Kuki buri penteste akeneye kumenya neza politiki yumutekano wibirimo

Politiki Yumutekano Ibirimo (CSP) yabaye imwe muburyo bukomeye bwo kurinda mushakisha kuruhande rwinyandiko zambukiranya imbuga (XSS), gutera inshinge, n'ibitero byo gukanda. Nyamara mubikorwa byo kugerageza kwinjira, imitwe ya CSP ikomeza kuba imwe mubintu bidakunze kugaragara - kandi ntibisobanutse - kugenzura umutekano. Ubushakashatsi bwakozwe mu 2024 bwasesenguye imbuga zisaga miliyoni imwe bwerekanye ko 12.8% bonyine bohereje imitwe ya CSP na gato, kandi muri zo, hafi 94% zirimo byibuze intege nke za politiki zishobora gukoreshwa. Kuri pentester, gusobanukirwa CSP ntabwo ari ubushake - ni itandukaniro riri hagati yisuzuma ryurwego rwo hejuru na raporo ishimangira mubyukuri umutekano wumukiriya.

Waba ukora isuzuma ryurubuga, guhiga bugi, cyangwa kubaka umutekano murwego rwubucuruzi rukora amakuru yumukiriya yoroheje, ubumenyi bwa CSP nishingiro. Aka gatabo karasenya CSP icyo aricyo, uko ikora munsi yumutwe, aho yananiwe, nuburyo abapenteste bashobora gusuzuma no kurenga kuri politiki idakomeye.

Niki Politiki Yumutekano Ibirimo Mubyukuri

Muri rusange, CSP ni uburyo bwo kumenyekanisha umutekano butangwa binyuze mumutwe wa HTTP (cyangwa bitamenyerewe, tagi ya ). Itegeka mushakisha inkomoko yibirimo - inyandiko, imiterere, amashusho, imyandikire, amakadiri, nibindi - byemewe kwikorera no gukora kurupapuro runaka. Iyo ibikoresho bitubahirije politiki, mushakisha irabihagarika kandi ihitamo kumenyesha ihohoterwa kugera ku ndunduro.

Impamvu yambere yari inyuma ya CSP kwari ukugabanya ibitero bya XSS. Ubwirinzi bwa XSS busanzwe nko kwinjiza isuku no gusohora kodegisi bifite akamaro ariko biracika - imiterere imwe yabuze cyangwa ikosa rya kodegisi irashobora kongera kwerekana intege nke. CSP yongeyeho kwirwanaho-byimbitse: niyo uwagabye igitero yinjije ikirango cyanditse muri DOM, politiki yashyizweho neza ibuza mushakisha kuyikora.

CSP ikorera kuri icyitegererezo cyabazungu . Aho kugerageza guhagarika ibizwi-bibi, bisobanura ibyemewe neza. Ibindi byose birahakana byanze bikunze. Uku guhinduranya icyitegererezo cyumutekano kirakomeye mubitekerezo, ariko mubikorwa, gukomeza politiki ihamye kurubuga rwurubuga rugoye - cyane cyane urubuga ruyobora ibice byinshi byahujwe nka CRM, inyemezabuguzi, isesengura, hamwe na sisitemu zo gutumaho - biragoye cyane.

Anatomy yumutwe wa CSP: Amabwiriza ninkomoko

Umutwe wa CSP ugizwe na amabwiriza , buri kugenzura ubwoko bwumutungo wihariye. Gusobanukirwa aya mabwiriza ni ngombwa kuri pentester yose isuzuma politiki yintego. Amabwiriza yingenzi cyane arimo isanzwe-src (gusubira inyuma kubuyobozi ubwo aribwo bwose butashyizweho neza), inyandiko-src (JavaScript ikorwa), style-src (CSS), img-src (amashusho), ikintu-src (amacomeka nka Flash cyangwa Java applet).

Buri mabwiriza yemera imwe cyangwa nyinshi imvugo yinkomoko isobanura inkomoko yemewe. Izi ntera kuva kumazina yihariye ( https://cdn.urugero.com ) kugeza kumagambo yagutse:

• 'kwigira' - yemerera ibikoresho biva mu nkomoko imwe ninyandiko
• 'ntayo' - ihagarika ibikoresho byose byubwoko
• 'umutekano-utari mwiza-
• amakuru: - yemerera amakuru URI nkisoko yibirimo

Umutwe-wukuri-CSP umutwe wa CSP urashobora kumera gutya: Ibirimo-Umutekano-Politiki: isanzwe-src 'wenyine'; inyandiko-src 'kwigira' https://cdn.jsdelivr.net 'nonce-abc123'; Imiterere-src 'kwigira' 'umutekano-utari mwiza'; img-src *; ikintu-src 'ntayo' . Nka pentester, akazi kawe nugusoma iyi politiki ugahita umenya aho ikomeye, aho ifite intege nke, naho ikoreshwa.

Ibisanzwe CSP Ibinyoma Abapenteste Bagomba Kwibanda

Ikinyuranyo hagati yo kohereza umutwe wa CSP no kohereza ingirakamaro umutwe wa CSP ni kinini. Mubikorwa, politiki nyinshi zirimo intege nke zatangijwe no korohereza abitezimbere, kwishyira hamwe kwabandi, cyangwa kutumvikana kworoshye. Mugihe cyo gusuzuma, abapenteste bagomba kugenzura buri gihe kunanirwa bisanzwe.

Iboneza nabi cyane ni ukubaho kwa 'umutekano-utari mwiza' mu buyobozi bwa inyandiko-src . Iri jambo rimwe ryibanze ryerekana inyungu zose zirwanya XSS za CSP mubyukuri ntacyo zimaze, kuko yemerera mushakisha gukora umurongo uwo ariwo wose