Add security headers

These headers are all pretty straightforward except CSP. For CSP I
defined the sources based on what was loaded from visiting the main page
and all crates. Images should be safe, so I've allowed them from all
sources.

This should be checked on staging before deploying.

Fixes rust-lang#586.

Author: sgrif

src/http.rs

@@ -1,11 +1,13 @@
+use conduit::{Request, Response};
+use conduit_middleware::Middleware;
 use curl;
 use curl::easy::{Easy, List};
 use oauth2::*;
 use app::App;
 use util::{CargoResult, internal, ChainError, human};
 use rustc_serialize::{json, Decodable};
 use std::str;
-
+use std::error::Error;
 
 /// Does all the nonsense for sending a GET to Github. Doesn't handle parsing
 /// because custom error-code handling may be desirable. Use
@@ -76,3 +78,38 @@ pub fn token(token: String) -> Token {
         token_type: String::new(),
     }
 }
+
+pub struct SecurityHeadersMiddleware;
+
+impl Middleware for SecurityHeadersMiddleware {
+    fn after(&self, _: &mut Request, mut res: Result<Response, Box<Error+Send>>)
+        -> Result<Response, Box<Error+Send>> {
+        if let Ok(ref mut response) = res {
+            response.headers.insert(
+                "Content-Security-Policy".into(),
+                vec!["default-src 'self'; \
+                      script-src 'self' https://www.google-analytics.com https://www.google.com; \
+                      style-src 'self' https://www.google.com; \
+                      img-src *; \
+                      object-src 'none'".into()],
+            );
+            response.headers.insert(
+                "X-Content-Type-Options".into(),
+                vec!["nosniff".into()],
+            );
+            response.headers.insert(
+                "X-Frame-Options".into(),
+                vec!["SAMEORIGIN".into()],
+            );
+            response.headers.insert(
+                "X-XSS-Protection".into(),
+                vec!["1; mode=block".into()],
+            );
+            response.headers.insert(
+                "Strict-Transport-Security".into(),
+                vec!["max-age=31536000; includeSubDomains".into()],
+            );
+        }
+        res
+    }
+}

src/lib.rs

@@ -150,6 +150,9 @@ pub fn middleware(app: Arc<App>) -> MiddlewareBuilder {
     m.add(conduit_cookie::Middleware::new(app.session_key.as_bytes()));
     m.add(conduit_cookie::SessionMiddleware::new("cargo_session",
                                                  env == Env::Production));
+    if env == Env::Production {
+        m.add(http::SecurityHeadersMiddleware);
+    }
     m.add(app::AppMiddleware::new(app));
     if env != Env::Test {
         m.add(db::TransactionMiddleware);