From 3e249bbc342474f8003fcc4dc83bf8d8e9687652 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?C=C3=A9dric=20FAMIBELLE-PRONZOLA?= <c.pronzola@tuta.io>
Date: Wed, 8 Jul 2026 07:33:40 +0400
Subject: [PATCH] feat: improve security headers and csp nonce handling

---
 categories.php               |  2 +-
 countdown.php                |  2 +-
 direct.php                   |  6 +--
 includes/header.php          |  2 +-
 includes/hero-section.php    |  2 +-
 includes/pwa-init.php        |  2 +-
 includes/security.php        | 73 +++++++++++++++++++++++-------------
 includes/structured-data.php |  3 +-
 index.php                    |  4 +-
 recherche.php                |  2 +-
 video.php                    |  6 +--
 11 files changed, 62 insertions(+), 42 deletions(-)

diff --git a/categories.php b/categories.php
index 50bb44f..f75b2bf 100644
--- a/categories.php
+++ b/categories.php
@@ -87,7 +87,7 @@ if ($categoryId && isset($allCategories[$categoryId])) {
     ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
diff --git a/countdown.php b/countdown.php
index ba34507..aae4781 100644
--- a/countdown.php
+++ b/countdown.php
@@ -57,7 +57,7 @@ setSecurityHeaders();
     <meta name="twitter:image" content="<?php echo 'https://' . $_SERVER['HTTP_HOST'] . '/img/logo.png'; ?>">
 
     <!-- Configuration JavaScript -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         const COUNTDOWN_TARGET_DATE = '<?php echo defined('COUNTDOWN_TARGET_DATE') ? COUNTDOWN_TARGET_DATE : '2025-10-11 00:00:00'; ?>';
     </script>
 </head>
diff --git a/direct.php b/direct.php
index 598cb8a..86b20bd 100644
--- a/direct.php
+++ b/direct.php
@@ -50,7 +50,7 @@ $liveStream = getLiveStream();
     <meta name="twitter:image" content="<?php echo getBaseUrl(); ?>/img/logo.png">
     
     <!-- Données structurées JSON-LD pour la page direct -->
-    <script type="application/ld+json">
+    <script type="application/ld+json" nonce="<?php echo getCspNonce(); ?>">
     {
         "@context": "https://schema.org",
         "@type": "WebPage",
@@ -85,7 +85,7 @@ $liveStream = getLiveStream();
     ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -163,7 +163,7 @@ $liveStream = getLiveStream();
                             $bgImageStyle = 'background-image: url(\'' . htmlspecialchars(NEXT_LIVE_IMAGE) . '\');';
                         }
                         ?>
-                        <div class="next-live-announcement" style="<?php echo $bgImageStyle; ?>">
+                        <div class="next-live-announcement" style="<?php echo $bgImageStyle; ?>" nonce="<?php echo getCspNonce(); ?>">
                             <?php if (!empty(NEXT_LIVE_IMAGE) && file_exists(NEXT_LIVE_IMAGE)): ?>
                                 <div class="next-live-image-container">
                                     <img src="<?php echo htmlspecialchars(NEXT_LIVE_IMAGE); ?>"
diff --git a/includes/header.php b/includes/header.php
index ffd9e48..ff83205 100644
--- a/includes/header.php
+++ b/includes/header.php
@@ -74,7 +74,7 @@
         <button id="theme-toggle" class="icon-button" aria-label="Basculer entre mode clair et sombre" title="Changer le thème">
             <i class="fas fa-sun" aria-hidden="true"></i>
         </button>
-        <button id="install-pwa" class="icon-button install-pwa-button" style="display: none;" aria-label="Installer l'application">
+        <button id="install-pwa" class="icon-button install-pwa-button" style="display: none;" nonce="<?php echo getCspNonce(); ?>" aria-label="Installer l'application">
             <i class="fas fa-download" aria-hidden="true"></i>
         </button>
         <button class="mobile-menu-toggle" aria-expanded="false" aria-controls="mobile-menu" aria-label="Ouvrir le menu de navigation">
diff --git a/includes/hero-section.php b/includes/hero-section.php
index 9edf2bf..92392a4 100644
--- a/includes/hero-section.php
+++ b/includes/hero-section.php
@@ -82,7 +82,7 @@ if ($heroType === 'none') {
                     $bgImageStyle = 'background-image: url(\'' . htmlspecialchars(NEXT_LIVE_IMAGE) . '\');';
                 }
                 ?>
-                <div class="hero-next-live" style="<?php echo $bgImageStyle; ?>">
+                <div class="hero-next-live" style="<?php echo $bgImageStyle; ?>" nonce="<?php echo getCspNonce(); ?>">
                     <?php if (!empty(NEXT_LIVE_IMAGE) && file_exists(NEXT_LIVE_IMAGE)): ?>
                         <div class="hero-next-live-image-container">
                             <img src="<?php echo htmlspecialchars(NEXT_LIVE_IMAGE); ?>"
diff --git a/includes/pwa-init.php b/includes/pwa-init.php
index d56a384..53b12a0 100644
--- a/includes/pwa-init.php
+++ b/includes/pwa-init.php
@@ -18,7 +18,7 @@ function addPWAHeaders() {
 function addPWAScripts() {
     ?>
     <!-- PWA Service Worker -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         if ('serviceWorker' in navigator) {
             window.addEventListener('load', function() {
                 navigator.serviceWorker.register('/sw.js')
diff --git a/includes/security.php b/includes/security.php
index 216680a..7d25762 100644
--- a/includes/security.php
+++ b/includes/security.php
@@ -177,26 +177,48 @@ function validateCSRFToken($token) {
     return hash_equals($_SESSION['csrf_token'], $token);
 }
 
+/**
+ * Génère ou récupère le nonce CSP de la requête courante.
+ * Doit être appelé après setSecurityHeaders() pour que le nonce soit envoyé dans le header CSP.
+ *
+ * @return string Nonce CSP
+ */
+function getCspNonce() {
+    if (!isset($GLOBALS['csp_nonce'])) {
+        $GLOBALS['csp_nonce'] = base64_encode(random_bytes(16));
+    }
+    return $GLOBALS['csp_nonce'];
+}
+
 /**
  * Applique des en-têtes de sécurité HTTP
  */
 function setSecurityHeaders() {
     // Protection contre le clickjacking (permettre les iframes du même site)
     header('X-Frame-Options: SAMEORIGIN');
-    
+
     // Protection contre le MIME sniffing
     header('X-Content-Type-Options: nosniff');
-    
+
     // Protection XSS basique
     header('X-XSS-Protection: 1; mode=block');
-    
+
     // Politique de référent
     header('Referrer-Policy: strict-origin-when-cross-origin');
-    
+
+    // Isolation cross-origin
+    header('Cross-Origin-Resource-Policy: same-origin');
+    header('Cross-Origin-Opener-Policy: same-origin');
+    header('Cross-Origin-Embedder-Policy: require-corp');
+
+    // Permissions Policy (feature policy)
+    header('Permissions-Policy: accelerometer=(), autoplay=(), camera=(), cross-origin-isolated=(), display-capture=(), encrypted-media=(), fullscreen=(self), geolocation=(), gyroscope=(), keyboard-map=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(self), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()');
+
     // Content Security Policy avec support Mastodon et PeerTube
+    $nonce = getCspNonce();
     $mastodonDomain = '';
     $peertubeDomain = '';
-    
+
     // Extraire le domaine Mastodon si configuré
     if (defined('MASTODON_INSTANCE_URL')) {
         $mastodonParsed = parse_url(MASTODON_INSTANCE_URL);
@@ -204,7 +226,7 @@ function setSecurityHeaders() {
             $mastodonDomain = $mastodonParsed['scheme'] . '://' . $mastodonParsed['host'];
         }
     }
-    
+
     // Extraire le domaine PeerTube si configuré
     if (defined('PEERTUBE_URL')) {
         $peertubeParsed = parse_url(PEERTUBE_URL);
@@ -212,15 +234,15 @@ function setSecurityHeaders() {
             $peertubeDomain = $peertubeParsed['scheme'] . '://' . $peertubeParsed['host'];
         }
     }
-    
+
     // Détecter si on est en développement local
     $isLocalDev = in_array($_SERVER['HTTP_HOST'] ?? '', ['127.0.0.1:8080', '127.0.0.1:8001', 'localhost:8080', 'localhost:8001', '127.0.0.1', 'localhost']);
-    
+
     $csp = "default-src 'self'; ";
-    $csp .= "style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; ";
-    $csp .= "script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://plausible.io; "; // PLAUSIBLE UPDATED
-    
-    // Images : autoriser les domaines externes plus HTTPS général en dev
+    $csp .= "style-src 'self' 'nonce-{$nonce}' https://cdnjs.cloudflare.com; ";
+    $csp .= "script-src 'self' 'nonce-{$nonce}' https://cdnjs.cloudflare.com https://plausible.io; ";
+
+    // Images : autoriser les domaines connus plus HTTPS général pour le contenu fédéré
     $imgSrc = "'self' data: " . ($mastodonDomain ? $mastodonDomain : '') . " " . ($peertubeDomain ? $peertubeDomain : '');
     if ($isLocalDev) {
         $imgSrc .= " https: http:";
@@ -228,34 +250,30 @@ function setSecurityHeaders() {
         $imgSrc .= " https:";
     }
     $csp .= "img-src " . $imgSrc . "; ";
-    
+
     $csp .= "font-src 'self' https://cdnjs.cloudflare.com; ";
-    
-    // Frames : autoriser PeerTube et HTTPS général
+
+    // Frames : autoriser PeerTube uniquement
     $frameSrc = "'self' " . ($peertubeDomain ? $peertubeDomain : '');
     if ($isLocalDev) {
         $frameSrc .= " https: http:";
-    } else {
-        $frameSrc .= " https:";
     }
     $csp .= "frame-src " . $frameSrc . "; ";
-    
-    // Connexions : autoriser Mastodon et PeerTube
+
+    // Connexions : autoriser Mastodon, PeerTube et Plausible
     $connectSrc = "'self' https://plausible.io " . ($mastodonDomain ? $mastodonDomain : '') . " " . ($peertubeDomain ? $peertubeDomain : '');
     if ($isLocalDev) {
         $connectSrc .= " ws: wss:"; // WebSockets pour le dev
     }
     $csp .= "connect-src " . $connectSrc . "; ";
-    
-    // Médias : toujours autoriser 'self', Mastodon et PeerTube
+
+    // Médias : autoriser 'self', Mastodon, PeerTube et S3 Mastodon
     $mediaSrc = "'self'";
 
-    // Ajouter l'instance Mastodon (pour les médias stockés sur l'instance)
     if ($mastodonDomain) {
         $mediaSrc .= " " . $mastodonDomain;
     }
 
-    // Ajouter PeerTube
     if ($peertubeDomain) {
         $mediaSrc .= " " . $peertubeDomain;
     }
@@ -277,13 +295,14 @@ function setSecurityHeaders() {
     $csp .= "media-src " . $mediaSrc . "; ";
 
     $csp .= "object-src 'none'; ";
-    $csp .= "base-uri 'self';";
-    
+    $csp .= "base-uri 'self'; ";
+    $csp .= "frame-ancestors 'self';";
+
     header('Content-Security-Policy: ' . $csp);
-    
+
     // HTTPS strict transport security (seulement si HTTPS)
     if (isset($_SERVER['HTTPS']) && $_SERVER['HTTPS'] === 'on') {
-        header('Strict-Transport-Security: max-age=31536000; includeSubDomains');
+        header('Strict-Transport-Security: max-age=63072000; includeSubDomains; preload');
     }
 }
 
diff --git a/includes/structured-data.php b/includes/structured-data.php
index b23d58d..14c45a2 100644
--- a/includes/structured-data.php
+++ b/includes/structured-data.php
@@ -313,7 +313,8 @@ function getBaseUrl() {
  * @param string $jsonLd Données JSON-LD
  */
 function outputJsonLd($jsonLd) {
-    echo '<script type="application/ld+json">' . "\n" . $jsonLd . "\n" . '</script>' . "\n";
+    $nonce = getCspNonce();
+    echo '<script type="application/ld+json" nonce="' . $nonce . '">' . "\n" . $jsonLd . "\n" . '</script>' . "\n";
 }
 
 ?>
diff --git a/index.php b/index.php
index abb4de7..f37e4ec 100644
--- a/index.php
+++ b/index.php
@@ -81,7 +81,7 @@ setSecurityHeaders();
     ?>
 
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -679,7 +679,7 @@ setSecurityHeaders();
     <script src="js/mastodon-config.php?v=<?php echo md5(MASTODON_INSTANCE_URL . MASTODON_DATE_FORMAT . MASTODON_BTN_SEE_MORE . MASTODON_BTN_RELOAD . MASTODON_MAX_POST_FETCH . MASTODON_MAX_POST_SHOW); ?>"></script>
 
     <!-- PWA Service Worker -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         if ('serviceWorker' in navigator) {
             window.addEventListener('load', function() {
                 navigator.serviceWorker.register('/sw.js')
diff --git a/recherche.php b/recherche.php
index 3aa052c..8670d4d 100644
--- a/recherche.php
+++ b/recherche.php
@@ -105,7 +105,7 @@ if ($resultsCount > 0) {
     <?php endif; ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
diff --git a/video.php b/video.php
index 4674ac8..400af99 100644
--- a/video.php
+++ b/video.php
@@ -167,7 +167,7 @@ if (empty($videoData) || isset($videoData['error'])) {
     <?php endif; ?>
     
     <!-- Script pour éviter le flash en mode sombre -->
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         (function() {
             const savedTheme = localStorage.getItem('theme');
             const systemPrefersDark = window.matchMedia && window.matchMedia('(prefers-color-scheme: dark)').matches;
@@ -330,7 +330,7 @@ if (empty($videoData) || isset($videoData['error'])) {
                                     <i class="fas fa-chevron-down" aria-hidden="true"></i>
                                 </button>
                             </div>
-                            <div id="full-description" class="full-description" style="display: none;">
+                            <div id="full-description" class="full-description" style="display: none;" nonce="<?php echo getCspNonce(); ?>">
                                 <?php echo markdown_to_html($video['description']); ?>
                                 <button class="show-less-btn" aria-expanded="true" aria-controls="full-description">
                                     <span>Voir moins</span>
@@ -566,7 +566,7 @@ if (empty($videoData) || isset($videoData['error'])) {
     </div>
     
     <script src="js/main.js"></script>
-    <script>
+    <script nonce="<?php echo getCspNonce(); ?>">
         // Script pour la modal de téléchargement
         document.addEventListener('DOMContentLoaded', function() {
             // Gestion de la description tronquée