Enable Permissions-Policy headers for browser feature restrictions. (#4621)

Addresses security scanner findings by denying unused browser APIs while preserving clipboard-write for copy-to-clipboard.

Co-authored-by: Peter Giacomo Lombardo <pglombardo@apnotic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

Author: 3 people

config/initializers/permissions_policy.rb

@@ -1,15 +1,61 @@
 # frozen_string_literal: true
 
 # Be sure to restart your server when you modify this file.
+#
+# Password Pusher is a form-based app: copy-to-clipboard is the main browser
+# capability we rely on. Everything else is denied by default.
+#
+# Rails emits Feature-Policy (legacy). Scanners expect Permissions-Policy
+# (modern syntax), so both are configured here.
 
-# Define an application-wide HTTP permissions policy. For further
-# information see: https://developers.google.com/web/updates/2018/06/feature-policy
+Rails.application.configure do
+  config.permissions_policy do |policy|
+    policy.accelerometer      :none
+    policy.ambient_light_sensor :none
+    policy.autoplay           :none
+    policy.camera             :none
+    policy.display_capture    :none
+    policy.encrypted_media    :none
+    policy.fullscreen         :none
+    policy.geolocation        :none
+    policy.gyroscope          :none
+    policy.hid                :none
+    policy.idle_detection     :none
+    policy.magnetometer       :none
+    policy.microphone         :none
+    policy.midi               :none
+    policy.payment            :none
+    policy.picture_in_picture :none
+    policy.screen_wake_lock   :none
+    policy.serial             :none
+    policy.sync_xhr           :none
+    policy.usb                :none
+    policy.web_share          :none
+  end
 
-# Rails.application.config.permissions_policy do |policy|
-#   policy.camera      :none
-#   policy.gyroscope   :none
-#   policy.microphone  :none
-#   policy.usb         :none
-#   policy.fullscreen  :self
-#   policy.payment     :self, "https://secure.example.com"
-# end
+  config.action_dispatch.default_headers["Permissions-Policy"] = [
+    "accelerometer=()",
+    "autoplay=()",
+    "camera=()",
+    "clipboard-write=(self)",
+    "display-capture=()",
+    "encrypted-media=()",
+    "fullscreen=()",
+    "geolocation=()",
+    "gyroscope=()",
+    "hid=()",
+    "idle-detection=()",
+    "magnetometer=()",
+    "microphone=()",
+    "midi=()",
+    "payment=()",
+    "picture-in-picture=()",
+    "publickey-credentials-get=()",
+    "screen-wake-lock=()",
+    "serial=()",
+    "sync-xhr=()",
+    "usb=()",
+    "web-share=()",
+    "xr-spatial-tracking=()"
+  ].join(", ")
+end

test/integration/permissions_policy_test.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+require "test_helper"
+
+class PermissionsPolicyTest < ActionDispatch::IntegrationTest
+  test "responses include permissions policy headers" do
+    get root_path
+
+    assert_response :success
+    assert response.headers["Permissions-Policy"].present?
+    assert_includes response.headers["Permissions-Policy"], "camera=()"
+    assert_includes response.headers["Permissions-Policy"], "clipboard-write=(self)"
+    assert_includes response.headers["Feature-Policy"], "camera 'none'"
+  end
+end