I-CSP YamaPentesta: Ukuqonda Okuyisisekelo

Kungani Yonke I-Pentester Idinga Ukuba Ingcweti Kwenqubomgomo Yokuphepha Kokuqukethwe

Inqubomgomo Yokuphepha Kokuqukethwe (CSP) isiphenduke enye yezindlela ezibaluleke kakhulu zokuvikela uhlangothi lwesiphequluli ngokumelene ne-cross-site scripting (XSS), umjovo wedatha, nokuhlasela kokuchofoza. Kodwa ekubandakanyekeni kokuhlola ukungena, izihloko ze-CSP zihlala zingenye yezilawuli zokuvikeleka ezivame ukungalungiswa kahle - futhi ezingaqondwa kahle. Ucwaningo lwango-2024 oluhlaziya amawebhusayithi angaphezu kwesigidi esingu-1 luthole ukuthi yi-12.8% kuphela ekhiphe izihloko ze-CSP nhlobo, futhi kulawo, cishe ama-94% aqukethe okungenani ubuthakathaka obubodwa benqubomgomo obungase busetshenziswe. Kubantu abadala, ukuqonda i-CSP akuyona inketho — kungumehluko phakathi kokuhlolwa kwezinga eliphezulu kanye nombiko oqinisa ukuma kokuvikeleka kweklayenti.

Kungakhathaliseki ukuthi wenza ukuhlolwa kwezinhlelo zokusebenza zewebhu, ukuzingela iziphazamisi, noma wakha ukuphepha endaweni yebhizinisi ephethe idatha yekhasimende ebucayi, ulwazi lwe-CSP luyisisekelo. Lo mhlahlandlela uchaza ukuthi iyini i-CSP, ukuthi isebenza kanjani ngaphansi kwe-hood, lapho yehluleka khona, nokuthi ama-pentesters angakwazi kanjani ukuhlola ngokuhlelekile futhi adlule izinqubomgomo ezibuthakathaka.

Yenzani Empeleni Inqubomgomo Yokuphepha Kokuqukethwe

Emnyombweni wayo, i-CSP iyindlela yokuvikela ememezelayo elethwa ngesihloko sempendulo ye-HTTP (noma ngaphansi ngokuvamile, umaka we-). Iyalela isiphequluli ukuthi imiphi imithombo yokuqukethwe - izikripthi, izitayela, izithombe, amafonti, amafreyimu, nokunye - okuvunyelwe ukulayisha nokukwenza ekhasini elinikeziwe. Uma insiza yephula inqubomgomo, isiphequluli siyayivimba futhi sibike ngokuzithandela ukwephulwa endaweni ethile yokugcina.

Isisusa sokuqala ngemuva kwe-CSP bekuwukunciphisa ukuhlasela kwe-XSS. Izivikelo ze-XSS zosiko ezifana nokuhlanza okokufaka kanye nombhalo wekhodi ophumayo ziyasebenza kodwa azinalutho — umongo owodwa ogejiwe noma iphutha lombhalo wekhodi lingaphinda lingenise ubungozi. I-CSP yengeza isendlalelo esijulile sokuzivikela: nanoma umhlaseli efaka umaka wombhalo oyingozi ku-DOM, inqubomgomo emiswe kahle ivimbela isiphequluli ukuthi singayisebenzisi.

I-CSP isebenza ngemodeli yohlu olugunyaziwe. Kunokuba uzame ukuvimba okuqukethwe okubi okwaziwayo, ichaza ukuthi yini evunyelwe ngokusobala. Konke okunye kwenqatshwa ngokuzenzakalela. Lokhu kuguqulwa kwemodeli yezokuphepha kunamandla ngokombono, kodwa empeleni, ukugcina izinqubomgomo eziqinile kuzo zonke izinhlelo zokusebenza zewebhu eziyinkimbinkimbi - ikakhulukazi izinkundla ezilawula inqwaba yamamojula ahlanganisiwe afana ne-CRM, ama-invoyisi, izibalo, nezinhlelo zokubhukha - kunzima kakhulu.

I-Anatomy Yesihloko se-CSP: Iziqondiso Nemithombo

Isihloko se-CSP sakhiwe ngeziqondiso, ngasinye silawula uhlobo oluthile lwensiza. Ukuqonda lezi ziqondiso kubalulekile kunoma iyiphi i-pentester ehlola inqubomgomo yalokho okuhlosiwe. Iziqondiso ezibaluleke kakhulu zifaka i-default-src (i-backback yanoma isiphi isiqondiso esingasethwanga ngokusobala), script-src ( JavaScript execution), style-src (CSS), img-src (izithombe), connect-src, connect-src, srcsrcsrcsrcsrc , WebSorc Ferc ,                                  ]                                                  ] (ama-iframe ashumekiwe), kanye nento-src (ama-plugin afana ne-Flash noma ama-applet we-Java).

Isiyalezo ngasinye samukela eyodwa noma ngaphezulu inkulumo yomthombo echaza umsuka ovunyelwe. Lokhu kusuka emagameni athile omethuleli (https://cdn.example.com) kuya kumagama angukhiye abanzi:

• 'self' — ivumela izinsiza ezisuka kumsuka ofanayo nowedokhumenti
• 'akekho' — ivimba zonke izinsiza zalolo hlobo
• 'okungaphephile ku-inthanethi' — ivumela izikripthi ezingaphakathi komugqa noma izitayela (inciphisa ngempumelelo ukuvikelwa kwe-XSS)
• 'unsafe-eval' — ivumela i-eval(), setTimeout(string), kanye nokusebenzisa ikhodi enamandla efanayo
• 'nonce-{random}' — ivumela izikripthi ezithile ezisemlayini ezimakwe nge-cryptographic nonce efanayo
• 'strict-dynamic' — izikripthi zethemba ezilayishwe izikripthi esezithenjiwe kakade, indiva izinhla zokuvumela ezisekelwe kumsingathi
• idatha: — ivumela ama-URL wedatha njengemithombo yokuqukethwe

Isihloko se-CSP somhlaba wangempela singase sibukeke kanje: Inqubomgomo-Yokuphepha-Okuqukethwe: okuzenzakalelayo-src 'self'; script-src 'self' https://cdn.jsdelivr.net 'nonce-abc123'; style-src 'self' 'engaphephile-inline'; img-src *; object-src 'akekho'. Njenge-pentester, umsebenzi wakho ukufunda le nqubomgomo futhi ubone ngokushesha lapho iqine khona, lapho ibuthaka khona, nalapho isebenziseka khona.

Ukungalungiseki Okujwayelekile Kwe-CSP Okumele Kuqondiswe AmaPentester

Igebe phakathi kokuphakela unhlokweni we-CSP nokukhipha unhlokweni osebenzayo we-CSP likhulu kakhulu. Empeleni, izinqubomgomo eziningi ziqukethe ubuthakathaka okwethulwa ukunethezeka konjiniyela, ukuhlanganiswa kwezinkampani zangaphandle, noma ukungaqondi kahle okulula. Ngesikhathi sokuhlola, ama-pentesters kufanele ahlole ngokuhlelekile lokhu kwehluleka okuvamile.

Ukulungiswa okungalungile okulimaza kakhulu ukuba khona 'kokungaphephile ku-inthanethi' ku-script-src yokuqondisa. Leli gama elingukhiye elilodwa lenza yonke inzuzo ephikisana ne-XSS ye-CSP ingabi nalusizo, ngoba ivumela isiphequluli ukuthi sisebenzise noma yimuphi umaka we-