-
Notifications
You must be signed in to change notification settings - Fork 3.2k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Selective CSP header directive stripping from HTTPResponse
- Loading branch information
Showing
18 changed files
with
1,167 additions
and
14 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| import type { OutgoingHttpHeaders } from 'http' | ||
|
|
||
| const cspRegExp = /[; ]*([^\n\r; ]+) ?([^\n\r;]+)*/g | ||
|
|
||
| export const nonceDirectives = ['script-src-elem', 'script-src', 'default-src'] | ||
|
|
||
| export const unsupportedCSPDirectives = [ | ||
| /** | ||
| * In order for Cypress to run content in an iframe, we must remove the `frame-ancestors` directive | ||
| * from the CSP header. This is because this directive behaves like the `X-Frame-Options='deny'` header | ||
| * and prevents the iframe content from being loaded if it detects that it is not being loaded in the | ||
| * top-level frame. | ||
| */ | ||
| 'frame-ancestors', | ||
| ] | ||
|
|
||
| const caseInsensitiveGetAllHeaders = (headers: OutgoingHttpHeaders, lowercaseProperty: string): string[] => { | ||
| return Object.entries(headers).reduce((acc: string[], [key, value]) => { | ||
| if (key.toLowerCase() === lowercaseProperty) { | ||
| // It's possible to set more than 1 CSP header, and in those instances CSP headers | ||
| // are NOT merged by the browser. Instead, the most **restrictive** CSP header | ||
| // that applies to the given resource will be used. | ||
| // https://www.w3.org/TR/CSP2/#content-security-policy-header-field | ||
| // | ||
| // Therefore, we need to return each header as it's own value so we can apply | ||
| // injection nonce values to each one, because we don't know which will be | ||
| // the most restrictive. | ||
| acc.push.apply( | ||
| acc, | ||
| `${value}`.split(',') | ||
| .filter(Boolean) | ||
| .map((policyString) => `${policyString}`.trim()), | ||
| ) | ||
| } | ||
|
|
||
| return acc | ||
| }, []) | ||
| } | ||
|
|
||
| function getCspHeaders (headers: OutgoingHttpHeaders, headerName: string = 'content-security-policy'): string[] { | ||
| return caseInsensitiveGetAllHeaders(headers, headerName.toLowerCase()) | ||
| } | ||
|
|
||
| export function hasCspHeader (headers: OutgoingHttpHeaders, headerName: string = 'content-security-policy') { | ||
| return getCspHeaders(headers, headerName).length > 0 | ||
| } | ||
|
|
||
| export function parseCspHeaders (headers: OutgoingHttpHeaders, headerName: string = 'content-security-policy', excludeDirectives: string[] = []): Map<string, string[]>[] { | ||
| const cspHeaders = getCspHeaders(headers, headerName) | ||
|
|
||
| // We must make an policy map for each CSP header individually | ||
| return cspHeaders.reduce((acc: Map<string, string[]>[], cspHeader) => { | ||
| const policies = new Map<string, string[]>() | ||
| let policy = cspRegExp.exec(cspHeader) | ||
|
|
||
| while (policy) { | ||
| const [/* regExpMatch */, directive, values = ''] = policy | ||
|
|
||
| if (!excludeDirectives.includes(directive)) { | ||
| const currentDirective = policies.get(directive) || [] | ||
|
|
||
| policies.set(directive, [...currentDirective, ...values.split(' ').filter(Boolean)]) | ||
| } | ||
|
|
||
| policy = cspRegExp.exec(cspHeader) | ||
| } | ||
|
|
||
| return [...acc, policies] | ||
| }, []) | ||
| } | ||
|
|
||
| export function generateCspDirectives (policies: Map<string, string[]>): string { | ||
| return Array.from(policies.entries()).map(([directive, values]) => `${directive} ${values.join(' ')}`).join('; ') | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.