[SOLVED] Possibility to deactivate db-logging of CSP reports?

TYPO3 Questions Security
1

As far as I can see, there is no build-in possibilty to disable the logging of a well-formed CSP report to the database, or am I missing something?
This is a security issue from my point of view, as a customer s website has been offline due to a full database recently (flooded with CSP reports).
Of course there are ways (redirect, htacess, …). But I think it would be nice to create a smarter/more obvious way (in the csp module, …)

1 Like
2

There are a few possibilities to deal with this:

  1. You can create a scheduler task (better: enhance the existing garbage collection task) and regulary clear the reports older than X from your database

  2. The CSP reporting modules are actually Request Middlewares: typo3/cms-backend/csp-report and typo3/cms-frontend/csp-report. You can put this into a sitepackages Configuration/RequestMiddlewares.php file (untested, but this should work):

return [
    'frontend' => [
        'typo3/cms-frontend/csp-report' => [
            'disabled' => true,
      ],
    ],
    'backend' => [
        'typo3/cms-backend/csp-report' => [
            'disabled' => true,
        ],
    ],
];

3.You can use the config option $GLOBALS['TYPO3_CONF_VARS']['FE']['contentSecurityPolicyReportingUrl'] and $GLOBALS['TYPO3_CONF_VARS']['BE']['contentSecurityPolicyReportingUrl'] (see Feature: #99499 - Introduce Content-Security-Policy handling — TYPO3 Core Changelog main documentation) to point to a (non logging / dummy) backend URL

HTH!

3 Likes
3

You could use the table garbage collection task in the scheduler to remove all reports older than X days. Add this to your additional.php.

$GLOBALS['TYPO3_CONF_VARS']['SC_OPTIONS']['scheduler']['tasks'][\TYPO3\CMS\Scheduler\Task\TableGarbageCollectionTask::class]['options']['tables']['sys_http_report'] = [
    'dateField' => 'created',
    'expirePeriod' => '7',
];
4 Likes
4

Thanks for your answers :+1: I was not aware that it is possible to disable middlewares, cool :slight_smile:

Concerning “3.” of your answer @ghi : this does not prevent logging using the default url (and thus can still be used to flood the database)

Still I would suggest the logging beeing disabled by default / without any user csp configuration

5

I suggest you report this as a bug, so it can be assessed and fixed by the Core Team.

1 Like