VnPower/PixivFE
1
0
Fork 0
mirror of https://codeberg.org/VnPower/PixivFE synced 2024-12-06 19:16:23 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

Apply stricter CSP, and document it. Fix typo in SCSS.

Browse Source 
Co-authored-by: perennial <mail@perennialte.ch>
This commit is contained in:
iacore
2024-02-16 12:29:40 +00:00
parent 973843a95f
commit 7f194a21bc
12 changed files with 53 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+1 -1
View File
@@ -11,7 +11,7 @@ A privacy-respecting alternative front-end for Pixiv that doesn't suck.
![CI badge](https://ci.codeberg.org/api/badges/12556/status.svg)
[![Go Report Card](https://goreportcard.com/badge/codeberg.org/vnpower/pixivfe)](https://goreportcard.com/report/codeberg.org/vnpower/pixivfe)
Questions? Feedback? You can [PM me](https://matrix.to/#/@vnpower:eientei.org) on Matrix!
Questions? Feedback? You can [PM me](https://matrix.to/#/@vnpower:eientei.org) on Matrix! You can also look in [Known Quirks Of PixivFE](spec/quirks.md) to see if your issue already has a known solution.
You can keep track of this project's development [here](https://codeberg.org/VnPower/PixivFE/wiki/Things-to-do).
core/config/config.go
+3 -2
View File
@@ -14,7 +14,8 @@ var GlobalServerConfig ServerConfig
type ServerConfig struct {
// Required
Token []string
ProxyServer string // authority part of the URL; no '/', no path, no protocol (default to https://)
// Deprecated: only store Origin instead
ProxyServerAuthority string // authority part of the URL; no '/', no path, no protocol (default to https://)
// can be left empty
Host string
@@ -106,7 +107,7 @@ func (s *ServerConfig) SetToken(v string) {
}
func (s *ServerConfig) SetProxyServer(v string) {
s.ProxyServer = v
s.ProxyServerAuthority = v
log.Printf("Set image proxy server to: %s\n", v)
}
core/config/session.go
+12 -7
View File
@@ -27,33 +27,38 @@ func saveSession(sess *session.Session) error {
}
func ProxyImageUrl(c *fiber.Ctx, s string) string {
proxy := GetImageProxy(c)
s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, "https://"+proxy)
proxyOrigin := GetImageProxyOrigin(c)
s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, proxyOrigin)
// s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, "/proxy/i.pximg.net")
s = strings.ReplaceAll(s, `https:\/\/s.pximg.net`, "/proxy/s.pximg.net")
return s
}
func ProxyImageUrlNoEscape(c *fiber.Ctx, s string) string {
proxy := GetImageProxy(c)
s = strings.ReplaceAll(s, `https://i.pximg.net`, "https://"+proxy)
proxyOrigin := GetImageProxyOrigin(c)
s = strings.ReplaceAll(s, `https://i.pximg.net`, proxyOrigin)
// s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, "/proxy/i.pximg.net")
s = strings.ReplaceAll(s, `https://s.pximg.net`, "/proxy/s.pximg.net")
return s
}
func GetImageProxy(c *fiber.Ctx) string {
func GetImageProxyOrigin(c *fiber.Ctx) string {
return "https://" + GetImageProxyAuthority(c)
}
// Deprecated: this function should be nuked.
func GetImageProxyAuthority(c *fiber.Ctx) string {
sess, err := Store.Get(c)
if err != nil {
log.Fatalln("Failed to get current session and its values! Falling back to server default!")
return GlobalServerConfig.ProxyServer
return GlobalServerConfig.ProxyServerAuthority
}
value := sess.Get("ImageProxy")
if value != nil {
return value.(string)
}
return GlobalServerConfig.ProxyServer
return GlobalServerConfig.ProxyServerAuthority
}
func GetRandomDefaultToken() string {
main.go
+3 -3
View File
@@ -2,6 +2,7 @@ package main
import (
"errors"
"fmt"
"log"
"net"
"net/http"
@@ -130,9 +131,8 @@ func main() {
c.Set("X-Content-Type-Options", "nosniff")
c.Set("Referrer-Policy", "no-referrer")
c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
// -- Allowing inline styles may be simpler and avoid breakage, but you lose a lot of the protection that CSP provides
// src: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src#unsafe_inline_styles
// c.Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'sha256-hyWmaJx4D/wwnSlHuylUcUEAHy4waDmxU5jgvi3ilCs='; style-src 'self' 'unsafe-inline'; img-src 'self' https:; connect-src 'self'; frame-ancestors 'self'; object-src 'none'")
c.Set("Content-Security-Policy", fmt.Sprintf("default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; connect-src 'self'", config.GetImageProxyOrigin(c)))
// add this if need iframe: ; frame-ancestors 'self'
return c.Next()
})
pages/about.go
+1 -1
View File
@@ -9,7 +9,7 @@ func AboutPage(c *fiber.Ctx) error {
info := fiber.Map{
"Time": core.GlobalServerConfig.StartingTime,
"Version": core.GlobalServerConfig.Version,
"ImageProxy": core.GlobalServerConfig.ProxyServer,
"ImageProxy": core.GlobalServerConfig.ProxyServerAuthority,
"AcceptLanguage": core.GlobalServerConfig.AcceptLanguage,
}
return c.Render("pages/about", info)
pages/proxy.go
+1 -1
View File
@@ -31,7 +31,7 @@ func SPximgProxy(c *fiber.Ctx) error {
}
func IPximgProxy(c *fiber.Ctx) error {
proxy_authority := config.GetImageProxy(c)
proxy_authority := config.GetImageProxyAuthority(c)
URL := fmt.Sprintf("https://%s/%s", proxy_authority, c.Params("*"))
req, _ := http.NewRequest("GET", URL, nil)
serve/template.go
+1 -1
View File
@@ -252,7 +252,7 @@ func GetTemplateFunctions() template.FuncMap {
return s[:len(s)-6]
},
"getImageProxyProtocolAuthority": func() string {
return "https://" + config.GlobalServerConfig.ProxyServer
return "https://" + config.GlobalServerConfig.ProxyServerAuthority
},
}
}
spec/quirks.md
+7
View File
@@ -0,0 +1,7 @@
## Why don't my userstyles work?
Origin: https://codeberg.org/VnPower/PixivFE/pulls/62#issuecomment-1568191
This website uses <abbr title="Content Security Policy">CSP</abbr>, which blocks the loading of inline styles. In the case of Stylus, you need to enable **Advanced > Circumvent CSP 'style-­src' via adoptedSty­leSheets** in Stylus Options.
Reference: https://github.com/openstyles/stylus/issues/1685
views/css/style.css
+1 -1
View File
@@ -226,7 +226,7 @@ input[type=submit][hidden] {
@keyframes rolling-something {
0% {
background-position-x: 0vm;
background-position-x: 0vw;
}
100% {
background-position-x: 40vw;
views/css/style.scss
+1 -1
View File
@@ -259,7 +259,7 @@ input[type="submit"][hidden] {
@keyframes rolling-something {
0% {
background-position-x: 0vm
background-position-x: 0vw
}
100% {
background-position-x: 40vw
views/js/on-page-load.js
+17
View File
@@ -0,0 +1,17 @@
// make 4xx 5xx responses swap in as well
addEventListener('htmx:beforeOnLoad', function (event) {
event.detail.shouldSwap = true;
event.detail.isError = false;
});
function closeNavigationMenu() {
document.getElementById("sidebar-toggler").checked = false
}
// browser built-in navigation
addEventListener("popstate", (event) => {
closeNavigationMenu()
});
// htmx triggered navigation
addEventListener("htmx:pushedIntoHistory", (event) => {
closeNavigationMenu()
});
views/layout.jet.html
+5 -22
View File
@@ -2,16 +2,17 @@
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="referrer" content="no-referrer" />
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' {{ getImageProxyProtocolAuthority() }}" />
<meta name="description" content="View this page on PixivFE." />
<meta name="viewport" content="width=device-width, initial-scale=1" />
{{ title := "" }} {{ if isset(Title) }} {{ title = Title }} {{ else }} {{
title = "PixivFE" }} {{ end }}
<title>{{ title }} - PixivFE</title>
<link href="/css/style.css" rel="stylesheet" />
<script src="/js/htmx@1.9.10.min.js" integrity="sha384-D1Kt99CQMDuVetoL1lrYwg5t+9QdHe7NLX/SoJYkXDFfX37iInKRy5xLSi8nO7UC"></script>
<meta name="htmx-config" content='{"includeIndicatorStyles":false}'>
<script src="/js/htmx@1.9.10.min.js" integrity="sha384-D1Kt99CQMDuVetoL1lrYwg5t+9QdHe7NLX/SoJYkXDFfX37iInKRy5xLSi8nO7UC"></script>
{{ if BaseURL }}
<meta property="og:title" content="{{ title }}" />
@@ -125,25 +126,7 @@
</div>
<div class="navbar-shadow"></div>
</nav>
<script>
// make 4xx 5xx responses swap in as well
addEventListener('htmx:beforeOnLoad', function (event) {
event.detail.shouldSwap = true;
event.detail.isError = false;
});
function closeNavigationMenu() {
document.getElementById("sidebar-toggler").checked = false
}
// browser built-in navigation
addEventListener("popstate", (event) => {
closeNavigationMenu()
});
// htmx triggered navigation
addEventListener("htmx:pushedIntoHistory", (event) => {
closeNavigationMenu()
});
</script>
<script src="/js/on-page-load.js"></script>
<main>
{{ embed() }}
</main>