Enable Content Security Policies

[mishaschwartz]

Motivation and Context

For security reasons, we should implement some CSP policies. This PR makes a first attempt at that.

Ideally we want to enforce strong policies using nonce keys in all cases. However, we currently depend on at least two javascript libraries (heic2any and mathjax) that require more lax CSP policies. MathJax at least has indicated that it is unlikely to improve (mathjax/MathJax#1988). Further discussion on the best way forward is needed.

TODO: further spot-checks of pages to see if the new CSP rules block things that shouldn't be blocked

Your Changes

Description:

Type of change (select all that apply):

• Other (please specify): security update

Testing

Questions and Comments (if applicable)

Checklist

• I have performed a self-review of my own code.
• I have fixed any Hound bot comments.
• I have verified that the TravisCI tests have passed.
• I have reviewed the test coverage changes reported on Coveralls.
• I have updated the Changelog.md file.
• I have described any required documentation changes below.

Required documentation changes (if applicable)

https://github.com/MarkUsProject/Markus/wiki/Pending-Changes#pr-5186

[david-yz-liu]

@mishaschwartz I'm testing these changes now, and have encountered 3 issues:

1. The flash message containers don't close when you click on the "X" (it seems there's an onclick attribute set there).
2. Under the exam template settings page, when you click on the "Add Template Division" link, 2 blank rows get added instead of just 1. (There's another bug which also occurs on master: when there's more than one exam template, clicking "Add Template Division" adds an empty row to every exam template's division table, not just the one that was clicked. You don't need to fix that here, just something I noticed.)
3. Under the automated test settings page, there's an error when adding a new tester. In the JS console: "Error compiling schema, function code: ..."

I'll try to do more testing on this today, but wanted to get these to you first!

[mishaschwartz]

@david-yz-liu Amazing! Thanks for finding those

[david-yz-liu]

Looking good! Left a few inline comments, and found two other issues;

1. Scanned exam issues: I think the CSP is blocking the PDF loading for the "Fix Scans" and "Assign Scans" pages.
2. In the codeviewer, there's a dynamically-generated toolbar with buttons for "view plan" and increasing/decreasing font size. The toolbar shows up but the buttons don't work.