Add strict CSP

Part of #296.

lib/app.js

@@ -8,6 +8,7 @@ const handlebars = require("handlebars");
 const httpGracefulShutdown = require("http-graceful-shutdown");
 const routes = require("./routes.js");
 
+const csp = require("./server-infra/csp.js");
 const errorHandler = require("./server-infra/error-handler.js");
 const handlebarsSectionHelper = require("./server-infra/handlebars-section-helper.js");
 const headers = require("./server-infra/headers.js");
@@ -29,6 +30,7 @@ app
       section: handlebarsSectionHelper
     }
   }))
+  .use(csp)
   .use(errorHandler)
   .use(headers)
   .use(router.routes())

lib/server-infra/csp.js

@@ -0,0 +1,11 @@
+"use strict";
+const { randomUUID } = require("crypto");
+
+module.exports = async (ctx, next) => {
+  const nonce = randomUUID();
+  ctx.state.cspNonce = nonce;
+
+  ctx.set("Content-Security-Policy", `object-src 'none'; script-src 'nonce-${nonce}'; base-uri 'none';`);
+
+  await next();
+};

views/agreement-status.hbs

@@ -98,7 +98,7 @@ label.disabled-control {
  <output id="result"></output>
 </form>
 
-<script>
+<script nonce="{{@koa.state.cspNonce}}">
 "use strict";
 (() => {
  const form = document.querySelector("#refresh-pr");

views/agreement.hbs

@@ -298,7 +298,7 @@ input[type="submit"] {
   </div>
  </details>
 
- <script>
+ <script nonce="{{@koa.state.cspNonce}}">
  "use strict";
  (() => {
   // Synchronize Scope options