-
Notifications
You must be signed in to change notification settings - Fork 1.6k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge pull request #15003 from Budibase/csp-updates
Csp updates
- Loading branch information
Showing
14 changed files
with
239 additions
and
22 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
118 changes: 118 additions & 0 deletions
118
packages/backend-core/src/middleware/contentSecurityPolicy.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,118 @@ | ||
| import crypto from "crypto" | ||
| import env from "../environment" | ||
|
|
||
| const CSP_DIRECTIVES = { | ||
| "default-src": ["'self'"], | ||
| "script-src": [ | ||
| "'self'", | ||
| "'unsafe-eval'", | ||
| "https://*.budibase.net", | ||
| "https://cdn.budi.live", | ||
| "https://js.intercomcdn.com", | ||
| "https://widget.intercom.io", | ||
| "https://d2l5prqdbvm3op.cloudfront.net", | ||
| "https://us-assets.i.posthog.com", | ||
| ], | ||
| "style-src": [ | ||
| "'self'", | ||
| "'unsafe-inline'", | ||
| "https://cdn.jsdelivr.net", | ||
| "https://fonts.googleapis.com", | ||
| "https://rsms.me", | ||
| "https://maxcdn.bootstrapcdn.com", | ||
| ], | ||
| "object-src": ["'none'"], | ||
| "base-uri": ["'self'"], | ||
| "connect-src": [ | ||
| "'self'", | ||
| "https://*.budibase.app", | ||
| "https://*.budibaseqa.app", | ||
| "https://*.budibase.net", | ||
| "https://api-iam.intercom.io", | ||
| "https://api-ping.intercom.io", | ||
| "https://app.posthog.com", | ||
| "https://us.i.posthog.com", | ||
| "wss://nexus-websocket-a.intercom.io", | ||
| "wss://nexus-websocket-b.intercom.io", | ||
| "https://nexus-websocket-a.intercom.io", | ||
| "https://nexus-websocket-b.intercom.io", | ||
| "https://uploads.intercomcdn.com", | ||
| "https://uploads.intercomusercontent.com", | ||
| "https://*.amazonaws.com", | ||
| "https://*.s3.amazonaws.com", | ||
| "https://*.s3.us-east-2.amazonaws.com", | ||
| "https://*.s3.us-east-1.amazonaws.com", | ||
| "https://*.s3.us-west-1.amazonaws.com", | ||
| "https://*.s3.us-west-2.amazonaws.com", | ||
| "https://*.s3.af-south-1.amazonaws.com", | ||
| "https://*.s3.ap-east-1.amazonaws.com", | ||
| "https://*.s3.ap-south-1.amazonaws.com", | ||
| "https://*.s3.ap-northeast-2.amazonaws.com", | ||
| "https://*.s3.ap-southeast-1.amazonaws.com", | ||
| "https://*.s3.ap-southeast-2.amazonaws.com", | ||
| "https://*.s3.ap-northeast-1.amazonaws.com", | ||
| "https://*.s3.ca-central-1.amazonaws.com", | ||
| "https://*.s3.cn-north-1.amazonaws.com", | ||
| "https://*.s3.cn-northwest-1.amazonaws.com", | ||
| "https://*.s3.eu-central-1.amazonaws.com", | ||
| "https://*.s3.eu-west-1.amazonaws.com", | ||
| "https://*.s3.eu-west-2.amazonaws.com", | ||
| "https://*.s3.eu-south-1.amazonaws.com", | ||
| "https://*.s3.eu-west-3.amazonaws.com", | ||
| "https://*.s3.eu-north-1.amazonaws.com", | ||
| "https://*.s3.sa-east-1.amazonaws.com", | ||
| "https://*.s3.me-south-1.amazonaws.com", | ||
| "https://*.s3.us-gov-east-1.amazonaws.com", | ||
| "https://*.s3.us-gov-west-1.amazonaws.com", | ||
| "https://api.github.com", | ||
| ], | ||
| "font-src": [ | ||
| "'self'", | ||
| "data:", | ||
| "https://cdn.jsdelivr.net", | ||
| "https://fonts.gstatic.com", | ||
| "https://rsms.me", | ||
| "https://maxcdn.bootstrapcdn.com", | ||
| "https://js.intercomcdn.com", | ||
| "https://fonts.intercomcdn.com", | ||
| ], | ||
| "frame-src": ["'self'", "https:"], | ||
| "img-src": ["http:", "https:", "data:", "blob:"], | ||
| "manifest-src": ["'self'"], | ||
| "media-src": [ | ||
| "'self'", | ||
| "https://js.intercomcdn.com", | ||
| "https://cdn.budi.live", | ||
| ], | ||
| "worker-src": ["blob:"], | ||
| } | ||
|
|
||
| export async function contentSecurityPolicy(ctx: any, next: any) { | ||
| try { | ||
| const nonce = crypto.randomBytes(16).toString("base64") | ||
|
|
||
| const directives = { ...CSP_DIRECTIVES } | ||
| directives["script-src"] = [ | ||
| ...CSP_DIRECTIVES["script-src"], | ||
| `'nonce-${nonce}'`, | ||
| ] | ||
|
|
||
| if (!env.DISABLE_CSP_UNSAFE_INLINE_SCRIPTS) { | ||
| directives["script-src"].push("'unsafe-inline'") | ||
| } | ||
|
|
||
| ctx.state.nonce = nonce | ||
|
|
||
| const cspHeader = Object.entries(directives) | ||
| .map(([key, sources]) => `${key} ${sources.join(" ")}`) | ||
| .join("; ") | ||
| ctx.set("Content-Security-Policy", cspHeader) | ||
| await next() | ||
| } catch (err: any) { | ||
| console.error( | ||
| `Error occurred in Content-Security-Policy middleware: ${err}` | ||
| ) | ||
| } | ||
| } | ||
|
|
||
| export default contentSecurityPolicy |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
75 changes: 75 additions & 0 deletions
75
packages/backend-core/src/middleware/tests/contentSecurityPolicy.spec.ts
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| import crypto from "crypto" | ||
| import contentSecurityPolicy from "../contentSecurityPolicy" | ||
|
|
||
| jest.mock("crypto", () => ({ | ||
| randomBytes: jest.fn(), | ||
| randomUUID: jest.fn(), | ||
| })) | ||
|
|
||
| describe("contentSecurityPolicy middleware", () => { | ||
| let ctx: any | ||
| let next: any | ||
| const mockNonce = "mocked/nonce" | ||
|
|
||
| beforeEach(() => { | ||
| ctx = { | ||
| state: {}, | ||
| set: jest.fn(), | ||
| } | ||
| next = jest.fn() | ||
| // @ts-ignore | ||
| crypto.randomBytes.mockReturnValue(Buffer.from(mockNonce, "base64")) | ||
| }) | ||
|
|
||
| afterEach(() => { | ||
| jest.clearAllMocks() | ||
| }) | ||
|
|
||
| it("should generate a nonce and set it in the script-src directive", async () => { | ||
| await contentSecurityPolicy(ctx, next) | ||
|
|
||
| expect(ctx.state.nonce).toBe(mockNonce) | ||
| expect(ctx.set).toHaveBeenCalledWith( | ||
| "Content-Security-Policy", | ||
| expect.stringContaining( | ||
| `script-src 'self' 'unsafe-eval' https://*.budibase.net https://cdn.budi.live https://js.intercomcdn.com https://widget.intercom.io https://d2l5prqdbvm3op.cloudfront.net https://us-assets.i.posthog.com 'nonce-${mockNonce}'` | ||
| ) | ||
| ) | ||
| expect(next).toHaveBeenCalled() | ||
| }) | ||
|
|
||
| it("should include all CSP directives in the header", async () => { | ||
| await contentSecurityPolicy(ctx, next) | ||
|
|
||
| const cspHeader = ctx.set.mock.calls[0][1] | ||
| expect(cspHeader).toContain("default-src 'self'") | ||
| expect(cspHeader).toContain("script-src 'self' 'unsafe-eval'") | ||
| expect(cspHeader).toContain("style-src 'self' 'unsafe-inline'") | ||
| expect(cspHeader).toContain("object-src 'none'") | ||
| expect(cspHeader).toContain("base-uri 'self'") | ||
| expect(cspHeader).toContain("connect-src 'self'") | ||
| expect(cspHeader).toContain("font-src 'self'") | ||
| expect(cspHeader).toContain("frame-src 'self'") | ||
| expect(cspHeader).toContain("img-src http: https: data: blob:") | ||
| expect(cspHeader).toContain("manifest-src 'self'") | ||
| expect(cspHeader).toContain("media-src 'self'") | ||
| expect(cspHeader).toContain("worker-src blob:") | ||
| }) | ||
|
|
||
| it("should handle errors and log an error message", async () => { | ||
| const consoleSpy = jest.spyOn(console, "error").mockImplementation() | ||
| const error = new Error("Test error") | ||
| // @ts-ignore | ||
| crypto.randomBytes.mockImplementation(() => { | ||
| throw error | ||
| }) | ||
|
|
||
| await contentSecurityPolicy(ctx, next) | ||
|
|
||
| expect(consoleSpy).toHaveBeenCalledWith( | ||
| `Error occurred in Content-Security-Policy middleware: ${error}` | ||
| ) | ||
| expect(next).not.toHaveBeenCalled() | ||
| consoleSpy.mockRestore() | ||
| }) | ||
| }) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.