Fix opy button, hide sidebar dynam anal, fix google analy csp

saferwall · Feb 7, 2022 · 789486a · 789486a
1 parent 36f26b3
commit 789486a
Show file tree

Hide file tree

Showing 4 changed files with 30 additions and 7 deletions.
diff --git a/entrypoint.sh b/entrypoint.sh
@@ -50,7 +50,9 @@ else
 
   sed -i "s/$HEAD_TAG/$GA_TAG\n$HEAD_TAG/g" $INDEX_HTML_FILE
 
-  sed -i "s~script-src~script-src https://www.google-analytics.com~g" $NGINX_CONF_FILE
+  sed -i "s~script-src~script-src https://www.google-analytics.com https://ssl.google-analytics.com
+~g" $NGINX_CONF_FILE
+  sed -i "s~img-src~img-src https://www.google-analytics.com~g" $NGINX_CONF_FILE
   sed -i "s~connect-src~connect-src https://www.google-analytics.com~g" $NGINX_CONF_FILE
 fi
 echo "[Info] Starting Nginx ..."

diff --git a/nginx.conf b/nginx.conf
@@ -17,7 +17,8 @@ server {
   add_header X-Frame-Options "DENY";
   add_header X-Content-Type-Options nosniff;
   add_header X-XSS-Protection "1; mode=block";
-  add_header Content-Security-Policy "default-src 'self'; font-src *; script-src 'unsafe-eval' 'self'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; object-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' data:; connect-src 'self';";
+  # TODO: generate nonce for vue js assets & remove unsafe-inline
+  add_header Content-Security-Policy "default-src 'self'; font-src *; script-src 'unsafe-eval' 'unsafe-inline' 'self'; style-src 'self' 'unsafe-inline' fonts.googleapis.com; object-src 'none'; base-uri 'self'; form-action 'self'; img-src 'self' https://cdnjs.cloudflare.com/ data:; connect-src 'self' https://cdnjs.cloudflare.com/;";
 
   location / {
     try_files $uri $uri/ @rewrites;

diff --git a/src/common/components/elements/button/BtnCopy.vue b/src/common/components/elements/button/BtnCopy.vue
@@ -15,11 +15,27 @@ const svgCopyIcon = `
 export default {
   methods: {
     copyContent(event) {
+      let parent = event.target.parentNode;
+
+      console.log(parent);
       // clone node and remove copy button
-      const nodeContent = event.target.parentNode.cloneNode(true);
-      nodeContent.querySelector("div[data-copy-element]").remove();
+      if (
+        parent.tagName != "svg" &&
+        !parent.hasAttribute("data-copy-btn") &&
+        !parent.hasAttribute("data-copy-element")
+      ) {
+        return;
+      }
+      while (!parent.hasAttribute("data-copy-element")) {
+        parent = parent.parentNode;
+      }
+      parent = parent.parentNode;
+
+      const nodeContent = parent.cloneNode(true);
+      let btnCopy = nodeContent.querySelector("div[data-copy-element]");
+      if (btnCopy) btnCopy.remove();
 
-      this.selectContent(event.target.parentNode);
+      this.selectContent(parent);
       this.updateClipboard(nodeContent.textContent, () => {
         const copySvg = this.getCopyButton(event);
         if (!copySvg) return;

diff --git a/src/common/components/partials/Sidebar.vue b/src/common/components/partials/Sidebar.vue
@@ -242,7 +242,7 @@ export default {
     hash: null,
     menuOpen: {
       "static-analysis": true,
-      "dynamic-analysis": true,
+      "dynamic-analysis": false,
     },
   }),
   computed: {
@@ -335,4 +335,8 @@ export default {
     }
   }
 }
-</style>
+
+.disabled {
+  @apply cursor-not-allowed;
+}
+</style>