-
-
Notifications
You must be signed in to change notification settings - Fork 90
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Refactoring CSP building out of RequestGuard.
- Loading branch information
1 parent
b5d7266
commit e82e961
Showing
6 changed files
with
143 additions
and
97 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,20 @@ | ||
| "use strict"; | ||
|
|
||
| function ReportingCSP(reportURI, reportGroup) { | ||
| return Object.assign( | ||
| new CapsCSP(new NetCSP( | ||
| `report-uri ${reportURI};`, | ||
| `;report-to ${reportGroup};` | ||
| )), | ||
| { | ||
| reportURI, | ||
| reportGroup, | ||
| reportToHeader: { | ||
| name: "Report-To", | ||
| value: JSON.stringify({ "url": reportURI, | ||
| "group": reportGroup, | ||
| "max-age": 10886400 }), | ||
| } | ||
| } | ||
| ); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| "use strict"; | ||
|
|
||
| function CapsCSP(baseCSP = new CSP()) { | ||
| return Object.assign(baseCSP, { | ||
| types: ["script", "object", "media"], | ||
| dataUriTypes: ["font", "media", "object"], | ||
| buildFromCapabilities(capabilities, netBlocker = false) { | ||
| let forbidData = new Set(this.dataUriTypes.filter(t => !capabilities.has(t))); | ||
| let blockedTypes; | ||
| if (netBlocker) { | ||
| blockedTypes = new Set(this.types.filter(t => !capabilities.has(t))); | ||
| } else if(!capabilities.has("script")) { | ||
| blockedTypes = new Set(["script"]); | ||
| forbidData.add("object"); // data: URIs loaded in objects may run scripts | ||
| } else { | ||
| blockedTypes = new Set(); | ||
| } | ||
|
|
||
| for (let type of forbidData) { | ||
| if (blockedTypes.has(type)) continue; | ||
| // HTTP is blocked in onBeforeRequest, let's allow it only and block | ||
| // for instance data: and blob: URIs | ||
| let dataBlocker = {name: type, value: "http: https:"}; | ||
| blockedTypes.add(dataBlocker) | ||
| } | ||
|
|
||
| return blockedTypes.size ? this.buildBlocker(...blockedTypes) : null; | ||
| } | ||
| }); | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| "use strict"; | ||
|
|
||
| class CSP { | ||
|
|
||
| build(...directives) { | ||
| return directives.join(';'); | ||
| } | ||
|
|
||
| buildBlocker(...types) { | ||
| return this.build(...(types.map(type => `${type.name || type}-src ${type.value || "'none'"}`))); | ||
| } | ||
|
|
||
| blocks(header, type) { | ||
| return `;${header};`.includes(`;${type}-src 'none';`) | ||
| } | ||
|
|
||
| asHeader(value) { | ||
| return {name: CSP.headerName, value}; | ||
| } | ||
| } | ||
|
|
||
| CSP.headerName = "content-security-policy"; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| "use strict"; | ||
|
|
||
| class NetCSP extends CSP { | ||
| constructor(start, end) { | ||
| super(); | ||
| this.start = start; | ||
| this.end = end; | ||
| } | ||
|
|
||
| isMine(header) { | ||
| let {name, value} = header; | ||
| if (name.toLowerCase() !== CSP.headerName) return false; | ||
| let startIdx = value.indexOf(this.start); | ||
| return startIdx > -1 && startIdx < value.lastIndexOf(this.end); | ||
| } | ||
|
|
||
| inject(headerValue, mine) { | ||
| let startIdx = headerValue.indexOf(this.start); | ||
| if (startIdx < 0) return `${headerValue};${mine}`; | ||
| let endIdx = headerValue.lastIndexOf(this.end); | ||
| let retValue = `${headerValue.substring(0, startIdx)}${mine}`; | ||
|
|
||
| return endIdx < 0 ? retValue : `${retValue}${headerValue.substring(endIdx + this.end.length + 1)}`; | ||
| } | ||
|
|
||
| build(...directives) { | ||
| return `${this.start}${super.build(...directives)}${this.end}`; | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters