mirrors/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2025-05-16 16:14:43 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

CSP: Add nonce to slide view inline JS

Browse source
This commit is contained in:
Literallie 2017-10-18 17:48:53 +02:00
parent 5d2d3ec875
commit 080436aebb
No known key found for this signature in database
GPG key ID: 7BE463C902ED152C
4 changed files with 11 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

7
app.js
View file

@ -12,6 +12,7 @@ var session = require('express-session')
var SequelizeStore = require('connect-session-sequelize')(session.Store)
var fs = require('fs')
var path = require('path')
var uuid = require('uuid')
var morgan = require('morgan')
var passportSocketIo = require('passport.socketio')
@ -108,6 +109,11 @@ if (config.hsts.enable) {
logger.info('https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security')
}
app.use((req, res, next) => {
res.locals.nonce = uuid.v4()
next()
})
// use Content-Security-Policy to limit XSS, dangerous plugins, etc.
// https://helmetjs.github.io/docs/csp/
if (config.csp.enable) {
@ -126,6 +132,7 @@ if (config.csp.enable) {
directives[propertyName] = directive;
}
}
directives.scriptSrc.push(function (req, res) { return "'nonce-" + res.locals.nonce + "'" })
if(config.csp.upgradeInsecureRequests === 'auto') {
directives.upgradeInsecureRequests = config.usessl === 'true'
} else {