hmcts · ChrisS1512 · Oct 14, 2024 · Oct 14, 2024 · Oct 16, 2024 · Oct 16, 2024
diff --git a/package.json b/package.json
@@ -88,7 +88,6 @@
         "passport-azure-ad": "4.3.5",
         "passport-custom": "^1.1.1",
         "postcss": "^8.4.47",
-        "pretty-print-json": "^2.1.2",
         "require-directory": "^2.1.1",
         "serve-favicon": "^2.5.0",
         "stylelint": "^16.9.0",

diff --git a/src/main/app.ts b/src/main/app.ts
@@ -37,7 +37,7 @@ import routes from './routes/routes';
 
 new AppInsights().enable();
 new Nunjucks(developmentMode).enableFor(app);
-new Helmet(config.get('security')).enableFor(app);
+new Helmet(config.get('security'), developmentMode).enableFor(app);
 new Container().enableFor(app);
 
 logger.info('environment', env);

diff --git a/src/main/assets/scss/main.scss b/src/main/assets/scss/main.scss
@@ -514,65 +514,7 @@ nav {
 }
 
 .json-container {
-    background-color: black;
-    border: 1px dashed yellow;
-    border-radius: 1em;
-}
-
-.json-key {
-    color: indianred;
-}
-
-.json-string {
-    color: darkkhaki;
-}
-
-.json-number {
-    color: deepskyblue;
-}
-
-.json-boolean {
-    color: mediumseagreen;
-}
-
-.json-null {
-    color: darkorange;
-}
-
-.json-mark {
-    color: silver;
-}
-
-a.json-link {
-    color: mediumorchid;
-}
-
-a.json-link:visited {
-    color: slategray;
-}
-
-a.json-link:hover {
-    color: violet;
-}
-
-a.json-link:active {
-    color: slategray;
-}
-
-ol.json-lines > li::marker {
-    color: silver;
-}
-
-ol.json-lines > li:nth-child(odd) {
-    background-color: #222;
-}
-
-ol.json-lines > li:nth-child(even) {
-    background-color: #161616;
-}
-
-ol.json-lines > li:hover {
-    background-color: dimgray;
+    padding-top: 10px;
 }
 
 .site-address {

diff --git a/src/main/controllers/system-admin/BlobViewJsonController.ts b/src/main/controllers/system-admin/BlobViewJsonController.ts
@@ -2,7 +2,6 @@ import { PipRequest } from '../../models/request/PipRequest';
 import { Response } from 'express';
 import { cloneDeep } from 'lodash';
 import { PublicationService } from '../../service/PublicationService';
-import { prettyPrintJson, FormatOptions } from 'pretty-print-json';
 import { LocationService } from '../../service/LocationService';
 import { UserManagementService } from '../../service/UserManagementService';
 import { HttpStatusCode } from 'axios';
@@ -19,8 +18,6 @@ export default class BlobViewJsonController {
 
         if (isValidList(data, metadata)) {
             const listTypes = publicationService.getListTypes();
-            const options: FormatOptions = { indent: 3, lineNumbers: true, trailingCommas: false };
-            const jsonData: string = prettyPrintJson.toHtml(data, options);
             const noMatchArtefact = metadata.locationId.toString().includes('NoMatch');
             let courtName = '';
             if (!noMatchArtefact) {
@@ -40,11 +37,10 @@ export default class BlobViewJsonController {
 
             res.render('system-admin/blob-view-json', {
                 ...cloneDeep(req.i18n.getDataByLanguage(req.lng)['blob-view-json']),
-                data,
+                data: JSON.stringify(data),
                 courtName,
                 artefactId,
                 metadata,
-                jsonData,
                 listUrl,
                 noMatchArtefact,
             });

diff --git a/src/main/modules/helmet/index.ts b/src/main/modules/helmet/index.ts
@@ -1,6 +1,7 @@
 import * as express from 'express';
 import * as helmet from 'helmet';
 import { B2C_ADMIN_URL, B2C_URL, CFT_IDAM_URL } from '../../helpers/envUrls';
+import { randomBytes } from 'crypto';
 
 export interface HelmetConfig {
     referrerPolicy: string;
@@ -9,13 +10,18 @@ export interface HelmetConfig {
 const self = "'self'";
 const googleAnalyticsDomains = ['*.googletagmanager.com', 'https://tagmanager.google.com', '*.google-analytics.com'];
 const dynatraceDomain = 'https://*.dynatrace.com';
-const jsdelivrDomain = '*.jsdelivr.net';
 
 /**
  * Module that enables helmet in the application
  */
 export class Helmet {
-    constructor(public config: HelmetConfig) {}
+    private readonly developmentMode: boolean;
+    constructor(
+        public config: HelmetConfig,
+        developmentMode
+    ) {
+        this.developmentMode = developmentMode;
+    }
 
     public enableFor(app: express.Express): void {
         // include default helmet functions
@@ -26,6 +32,22 @@ export class Helmet {
     }
 
     private setContentSecurityPolicy(app: express.Express): void {
+        app.use((req, res, next) => {
+            res.locals.cspNonce = randomBytes(32).toString('hex');
+            next();
+        });
+
+        const scriptSrc = [
+            self,
+            ...googleAnalyticsDomains,
+            dynatraceDomain,
+            (req, res) => `'nonce-${res['locals'].cspNonce}'`,
+        ];
+
+        if (this.developmentMode) {
+            scriptSrc.push("'unsafe-eval'");
+        }
+
         app.use(
             helmet.contentSecurityPolicy({
                 directives: {
@@ -34,17 +56,10 @@ export class Helmet {
                     fontSrc: [self, 'data:'],
                     imgSrc: [self, ...googleAnalyticsDomains, dynatraceDomain],
                     objectSrc: [self],
-                    scriptSrcAttr: [self, "'unsafe-inline'"],
-                    manifestSrc: [self, process.env.FRONTEND_URL],
-                    scriptSrc: [
-                        self,
-                        ...googleAnalyticsDomains,
-                        dynatraceDomain,
-                        jsdelivrDomain,
-                        "'unsafe-eval'",
-                        "'unsafe-inline'",
-                    ],
-                    styleSrc: [self, process.env.FRONTEND_URL],
+                    scriptSrcAttr: [self],
+                    manifestSrc: [self],
+                    scriptSrc,
+                    styleSrc: [self],
                     formAction: [self, B2C_URL, B2C_ADMIN_URL, CFT_IDAM_URL],
                 },
             })

diff --git a/src/main/resources/locales/cy/template.json b/src/main/resources/locales/cy/template.json
@@ -14,7 +14,7 @@
         "link9": "Remove",
         "link10": "Admin Dashboard"
     },
-    "betaHeading": "Mae hwn yn wasanaeth newydd – bydd eich <a id=\"betalink\" class=\"govuk-link\" href=\"https://www.smartsurvey.co.uk/s/FBSPI22/?pageurl=\">adborth</a> yn ein helpu i’w wella <a class=\"languageHeader govuk-link\" href=\"javascript:void(0)\" onclick=\"changeLang('en')\">English</a>",
+    "betaHeading": "Mae hwn yn wasanaeth newydd – bydd eich <a id=\"betalink\" class=\"govuk-link\" href=\"https://www.smartsurvey.co.uk/s/FBSPI22/?pageurl=\">adborth</a> yn ein helpu i’w wella <a class=\"languageHeader govuk-link\" href=\"#\">English</a>",
     "betaHeadingAdmin": "Mae hwn yn wasanaeth newydd – bydd eich <a id=\"betalink\" class=\"govuk-link\" href=\"https://www.smartsurvey.co.uk/s/FBSPI22/?pageurl=\">adborth</a> yn ein helpu i’w wella",
     "footerLinks": [
         {

diff --git a/src/main/resources/locales/en/template.json b/src/main/resources/locales/en/template.json
@@ -2,7 +2,7 @@
     "serviceNameText": "Court and tribunal hearings",
     "signInText": "Sign in",
     "signOutText": "Sign out",
-    "betaHeading": "This is a new service – your <a id=\"betalink\" class=\"govuk-link\" href=\"https://www.smartsurvey.co.uk/s/FBSPI22/?pageurl=\">feedback</a> will help us to improve it. <a class=\"languageHeader govuk-link\" href=\"javascript:void(0)\" onclick=\"changeLang('cy')\">Cymraeg</a>",
+    "betaHeading": "This is a new service – your <a id=\"betalink\" class=\"govuk-link\" href=\"https://www.smartsurvey.co.uk/s/FBSPI22/?pageurl=\">feedback</a> will help us to improve it. <a class=\"languageHeader govuk-link\" href=\"#\">Cymraeg</a>",
     "betaHeadingAdmin": "This is a new service – your <a id=\"betalink\" class=\"govuk-link\" href=\"https://www.smartsurvey.co.uk/s/FBSPI22/?pageurl=\">feedback</a> will help us to improve it.",
     "navLinks": {
         "link1": "Home",

diff --git a/src/main/views/accessibility-statement.njk b/src/main/views/accessibility-statement.njk
@@ -7,7 +7,7 @@
 
 {% block beforeContent %}
   {{ super() }}
-  {{ goBack(text = backButton) }}
+  {{ goBack(text = backButton, cspNonce = cspNonce) }}
 {% endblock %}
 
 {% block content %}

diff --git a/src/main/views/account-home.njk b/src/main/views/account-home.njk
@@ -7,7 +7,7 @@
 {% endblock %}
 {% block beforeContent %}
     {{ super() }}
-    {{ goBack(text = backButton) }}
+    {{ goBack(text = backButton, cspNonce = cspNonce) }}
 {% endblock %}
 {% block content %}
   {% if showVerifiedBanner %}

diff --git a/src/main/views/admin-rejected-login.njk b/src/main/views/admin-rejected-login.njk
@@ -7,7 +7,7 @@
     <li class="moj-sub-navigation__item">
       <a class="moj-sub-navigation__link govuk-!-font-size-16t" href="/">Home</a>
   </ul>
-  {{ goBack() }}
+  {{ goBack(cspNonce = cspNonce) }}
 {% endblock %}
 {% block pageTitle %}
   {{ header }}

diff --git a/src/main/views/admin/admin-dashboard.njk b/src/main/views/admin/admin-dashboard.njk
@@ -7,7 +7,7 @@
 {% endblock %}
 {% block beforeContent %}
     {{ super() }}
-    {{ goBack() }}
+    {{ goBack(cspNonce = cspNonce) }}
 {% endblock %}
 {% block content %}
 <div class="parent-box">

diff --git a/src/main/views/admin/admin-management.njk b/src/main/views/admin/admin-management.njk
@@ -1,5 +1,5 @@
 {% extends "../template.njk" %}
-{% from "../macros/common-components.njk" import submitButton, goBack %}
+{% from "../macros/common-components.njk" import submitButton, goBack, backButtonHistory %}
 {% from "govuk/components/input/macro.njk" import govukInput %}
 {% from "govuk/components/error-summary/macro.njk" import govukErrorSummary %}
 
@@ -9,7 +9,7 @@
 
 {% block beforeContent %}
   {{ super() }}
-  {{ goBack() }}
+  {{ goBack(cspNonce = cspNonce) }}
 {% endblock %}
 
 {% block content %}
@@ -63,15 +63,11 @@
       </div>
       {{ submitButton(continueButton) }}
     </form>
-    <script>
-      if ( window.history.replaceState ) {
-        window.history.replaceState( null, null, window.location.href );
-      }
-    </script>
     {{ super() }}
   </div>
 {% endblock %}
 
 {% block bodyEnd %}
   {{ super() }}
+  {{ backButtonHistory(cspNonce) }}
 {% endblock %}
diff --git a/src/main/views/admin/create-admin-account-summary.njk b/src/main/views/admin/create-admin-account-summary.njk
@@ -1,5 +1,5 @@
 {% extends "../template.njk" %}
-{% from "../macros/common-components.njk" import goBack, submitButton, successPanel %}
+{% from "../macros/common-components.njk" import goBack, submitButton, successPanel, backButtonHistory %}
 {% from "govuk/components/summary-list/macro.njk" import govukSummaryList %}
 {% from "govuk/components/error-summary/macro.njk" import govukErrorSummary %}
 
@@ -8,7 +8,7 @@
 {% endblock %}
 {% block beforeContent %}
     {{ super() }}
-    {{ goBack() }}
+    {{ goBack(cspNonce = cspNonce) }}
 {% endblock %}
 {% block content %}
     {% if displayError %}
@@ -111,16 +111,13 @@
 {% endblock %}
 {% block bodyEnd %}
     {{ super() }}
-    <script>
+    <script nonce="{{ cspNonce }}">
       if ({{ accountCreated }}) {
         const actions = document.getElementsByClassName('govuk-summary-list__actions');
         for(let i = 0; i < actions.length; i++) {
           actions[i].style.display = 'none';
         }
       }
-
-      if (window.history.replaceState) {
-        window.history.replaceState(null, null, window.location.href);
-      }
     </script>
+    {{ backButtonHistory(cspNonce) }}
 {% endblock %}
diff --git a/src/main/views/admin/create-admin-account.njk b/src/main/views/admin/create-admin-account.njk
@@ -1,5 +1,5 @@
 {% extends "../template.njk" %}
-{% from "../macros/common-components.njk" import goBack, submitButton %}
+{% from "../macros/common-components.njk" import goBack, submitButton, backButtonHistory %}
 {% from "govuk/components/input/macro.njk" import govukInput %}
 {% from "govuk/components/error-summary/macro.njk" import govukErrorSummary %}
 {% from "govuk/components/radios/macro.njk" import govukRadios %}
@@ -9,7 +9,7 @@
 {% endblock %}
 {% block beforeContent %}
     {{ super() }}
-    {{ goBack() }}
+    {{ goBack(cspNonce = cspNonce) }}
 {% endblock %}
 {% block content %}
     {% if formErrors %}
@@ -111,9 +111,5 @@
 {% endblock %}
 {% block bodyEnd %}
     {{ super() }}
-    <script>
-      if ( window.history.replaceState ) {
-        window.history.replaceState( null, null, window.location.href );
-      }
-    </script>
+    {{ backButtonHistory(cspNonce) }}
 {% endblock %}
diff --git a/src/main/views/admin/delete-user-confirmation.njk b/src/main/views/admin/delete-user-confirmation.njk
@@ -1,4 +1,4 @@
-{% from "../macros/common-components.njk" import goBack, successPanel %}
+{% from "../macros/common-components.njk" import goBack, successPanel, backButtonHistory %}
 
 {% extends "../template.njk" %}
 {% block pageTitle %}
@@ -7,7 +7,7 @@
 
 {% block beforeContent %}
   {{ super() }}
-  {{ goBack(text = backButton) }}
+  {{ goBack(text = backButton, cspNonce = cspNonce) }}
 {% endblock %}
 
 {% block content %}
@@ -40,9 +40,5 @@
 {% endblock %}
 {% block bodyEnd %}
   {{ super() }}
-  <script>
-    if ( window.history.replaceState ) {
-      window.history.replaceState( null, null, window.location.href );
-    }
-  </script>
+  {{ backButtonHistory(cspNonce) }}
 {% endblock %}
diff --git a/src/main/views/admin/delete-user.njk b/src/main/views/admin/delete-user.njk
@@ -1,5 +1,5 @@
 {% from "govuk/components/table/macro.njk" import govukTable as 'govukTable' %}
-{% from "../macros/common-components.njk" import goBack, submitButton %}
+{% from "../macros/common-components.njk" import goBack, submitButton, backButtonHistory %}
 {% from "govuk/components/radios/macro.njk" import govukRadios %}
 {% from "govuk/components/input/macro.njk" import govukInput %}
 
@@ -10,7 +10,7 @@
 
 {% block beforeContent %}
   {{ super() }}
-  {{ goBack(text = backButton) }}
+  {{ goBack(text = backButton, cspNonce = cspNonce) }}
 {% endblock %}
 
 {% block content %}
@@ -44,16 +44,14 @@
 {% endblock %}
 {% block bodyEnd %}
   {{ super() }}
-  <script>
+  <script nonce="{{ cspNonce }}">
     const button = document.getElementsByClassName('govuk-button')[0];
     button.addEventListener('click', (e) => {
       const checkedRadios = document.querySelectorAll('input[type="radio"]:checked');
       if (!checkedRadios.length) {
         e.preventDefault();
       }
     });
-    if ( window.history.replaceState ) {
-      window.history.replaceState( null, null, window.location.href );
-    }
   </script>
+  {{ backButtonHistory(cspNonce) }}
 {% endblock %}