mirror of https://github.com/ghostfolio/ghostfolio
Thomas Kaul
3 days ago
committed by
GitHub
GitHub
7 changed files with 188 additions and 38 deletions
@ -0,0 +1,104 @@ |
|||||
|
import helmet from 'helmet'; |
||||
|
import { IncomingMessage, ServerResponse } from 'node:http'; |
||||
|
|
||||
|
import { getHelmetOptions } from './security-headers.helper'; |
||||
|
|
||||
|
/** |
||||
|
* Gives the headers which the helmet middleware sets on a response with the |
||||
|
* options of the helper, and the function which it calls as next middleware. |
||||
|
*/ |
||||
|
function getHeaders({ |
||||
|
isSubscriptionEnabled |
||||
|
}: { |
||||
|
isSubscriptionEnabled: boolean; |
||||
|
}) { |
||||
|
const headers = new Map<string, string>(); |
||||
|
const next = jest.fn(); |
||||
|
|
||||
|
const response = { |
||||
|
removeHeader: (name: string) => { |
||||
|
headers.delete(name.toLowerCase()); |
||||
|
}, |
||||
|
setHeader: (name: string, value: string) => { |
||||
|
headers.set(name.toLowerCase(), value); |
||||
|
} |
||||
|
}; |
||||
|
|
||||
|
helmet(getHelmetOptions({ isSubscriptionEnabled }))( |
||||
|
{} as IncomingMessage, |
||||
|
response as unknown as ServerResponse, |
||||
|
next |
||||
|
); |
||||
|
|
||||
|
return { headers, next }; |
||||
|
} |
||||
|
|
||||
|
describe('getHelmetOptions', () => { |
||||
|
describe('without the subscription', () => { |
||||
|
let headers: Map<string, string>; |
||||
|
let next: jest.Mock; |
||||
|
|
||||
|
beforeAll(() => { |
||||
|
({ headers, next } = getHeaders({ isSubscriptionEnabled: false })); |
||||
|
}); |
||||
|
|
||||
|
it('should call the next middleware without an error', () => { |
||||
|
expect(next).toHaveBeenCalledWith(); |
||||
|
}); |
||||
|
|
||||
|
it('should set the Content-Security-Policy header', () => { |
||||
|
expect(headers.get('content-security-policy')).toContain( |
||||
|
"default-src 'self'" |
||||
|
); |
||||
|
}); |
||||
|
|
||||
|
it('should not upgrade insecure requests', () => { |
||||
|
expect(headers.get('content-security-policy')).not.toContain( |
||||
|
'upgrade-insecure-requests' |
||||
|
); |
||||
|
}); |
||||
|
|
||||
|
it('should not set the Strict-Transport-Security header', () => { |
||||
|
expect(headers.has('strict-transport-security')).toBe(false); |
||||
|
}); |
||||
|
|
||||
|
it('should not set the Cross-Origin-Opener-Policy header', () => { |
||||
|
expect(headers.has('cross-origin-opener-policy')).toBe(false); |
||||
|
}); |
||||
|
|
||||
|
it('should not allow resources of Stripe', () => { |
||||
|
expect(headers.get('content-security-policy')).not.toContain( |
||||
|
'https://js.stripe.com' |
||||
|
); |
||||
|
}); |
||||
|
}); |
||||
|
|
||||
|
describe('with the subscription', () => { |
||||
|
let headers: Map<string, string>; |
||||
|
let next: jest.Mock; |
||||
|
|
||||
|
beforeAll(() => { |
||||
|
({ headers, next } = getHeaders({ isSubscriptionEnabled: true })); |
||||
|
}); |
||||
|
|
||||
|
it('should call the next middleware without an error', () => { |
||||
|
expect(next).toHaveBeenCalledWith(); |
||||
|
}); |
||||
|
|
||||
|
it('should upgrade insecure requests', () => { |
||||
|
expect(headers.get('content-security-policy')).toContain( |
||||
|
'upgrade-insecure-requests' |
||||
|
); |
||||
|
}); |
||||
|
|
||||
|
it('should set the Strict-Transport-Security header', () => { |
||||
|
expect(headers.has('strict-transport-security')).toBe(true); |
||||
|
}); |
||||
|
|
||||
|
it('should allow resources of Stripe', () => { |
||||
|
expect(headers.get('content-security-policy')).toContain( |
||||
|
'https://js.stripe.com' |
||||
|
); |
||||
|
}); |
||||
|
}); |
||||
|
}); |
||||
@ -0,0 +1,37 @@ |
|||||
|
import { HelmetOptions } from 'helmet'; |
||||
|
|
||||
|
export function getHelmetOptions({ |
||||
|
isSubscriptionEnabled |
||||
|
}: { |
||||
|
isSubscriptionEnabled: boolean; |
||||
|
}): HelmetOptions { |
||||
|
if (isSubscriptionEnabled) { |
||||
|
return { |
||||
|
contentSecurityPolicy: { |
||||
|
directives: { |
||||
|
connectSrc: ["'self'", 'https://js.stripe.com'], // Allow connections to Stripe
|
||||
|
frameSrc: ["'self'", 'https://js.stripe.com'], // Allow loading frames from Stripe
|
||||
|
scriptSrc: ["'self'", "'unsafe-inline'", 'https://js.stripe.com'], // Allow inline scripts and scripts from Stripe
|
||||
|
scriptSrcAttr: ["'self'", "'unsafe-inline'"], // Allow inline event handlers
|
||||
|
styleSrc: ["'self'", "'unsafe-inline'"] // Allow inline styles
|
||||
|
} |
||||
|
}, |
||||
|
crossOriginOpenerPolicy: false // Disable Cross-Origin-Opener-Policy header (for Internet Identity)
|
||||
|
}; |
||||
|
} |
||||
|
|
||||
|
// The self-hosted setup can run via HTTP, hence the headers which need HTTPS
|
||||
|
// are disabled (see https://github.com/ghostfolio/ghostfolio/issues/2102)
|
||||
|
return { |
||||
|
contentSecurityPolicy: { |
||||
|
directives: { |
||||
|
scriptSrc: ["'self'", "'unsafe-inline'"], // Allow inline scripts
|
||||
|
scriptSrcAttr: ["'self'", "'unsafe-inline'"], // Allow inline event handlers
|
||||
|
styleSrc: ["'self'", "'unsafe-inline'"], // Allow inline styles
|
||||
|
upgradeInsecureRequests: null // Disable upgrade-insecure-requests directive (the browser changes each request to HTTPS, which gives a blank page via HTTP)
|
||||
|
} |
||||
|
}, |
||||
|
crossOriginOpenerPolicy: false, // Disable Cross-Origin-Opener-Policy header (the browser ignores it via HTTP)
|
||||
|
strictTransportSecurity: false // Disable Strict-Transport-Security header (the reverse proxy sets it, if HTTPS is required)
|
||||
|
}; |
||||
|
} |
||||
Loading…
Reference in new issue