From 7f194a21bcb35969dcc9f6331c7582ee6549e989 Mon Sep 17 00:00:00 2001 From: iacore Date: Fri, 16 Feb 2024 12:29:40 +0000 Subject: [PATCH] Apply stricter CSP, and document it. Fix typo in SCSS. Co-authored-by: perennial --- README.md | 2 +- core/config/config.go | 5 +++-- core/config/session.go | 19 ++++++++++++------- main.go | 6 +++--- pages/about.go | 2 +- pages/proxy.go | 2 +- serve/template.go | 2 +- spec/quirks.md | 7 +++++++ views/css/style.css | 2 +- views/css/style.scss | 2 +- views/js/on-page-load.js | 17 +++++++++++++++++ views/layout.jet.html | 27 +++++---------------------- 12 files changed, 53 insertions(+), 40 deletions(-) create mode 100644 spec/quirks.md create mode 100644 views/js/on-page-load.js diff --git a/README.md b/README.md index 9f1d519..7e5301a 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ A privacy-respecting alternative front-end for Pixiv that doesn't suck. ![CI badge](https://ci.codeberg.org/api/badges/12556/status.svg) [![Go Report Card](https://goreportcard.com/badge/codeberg.org/vnpower/pixivfe)](https://goreportcard.com/report/codeberg.org/vnpower/pixivfe) -Questions? Feedback? You can [PM me](https://matrix.to/#/@vnpower:eientei.org) on Matrix! +Questions? Feedback? You can [PM me](https://matrix.to/#/@vnpower:eientei.org) on Matrix! You can also look in [Known Quirks Of PixivFE](spec/quirks.md) to see if your issue already has a known solution. You can keep track of this project's development [here](https://codeberg.org/VnPower/PixivFE/wiki/Things-to-do). diff --git a/core/config/config.go b/core/config/config.go index 5e5e920..97e8e1e 100644 --- a/core/config/config.go +++ b/core/config/config.go @@ -14,7 +14,8 @@ var GlobalServerConfig ServerConfig type ServerConfig struct { // Required Token []string - ProxyServer string // authority part of the URL; no '/', no path, no protocol (default to https://) + // Deprecated: only store Origin instead + ProxyServerAuthority string // authority part of the URL; no '/', no path, no protocol (default to https://) // can be left empty Host string @@ -106,7 +107,7 @@ func (s *ServerConfig) SetToken(v string) { } func (s *ServerConfig) SetProxyServer(v string) { - s.ProxyServer = v + s.ProxyServerAuthority = v log.Printf("Set image proxy server to: %s\n", v) } diff --git a/core/config/session.go b/core/config/session.go index 58d5163..e7eb1cb 100644 --- a/core/config/session.go +++ b/core/config/session.go @@ -27,33 +27,38 @@ func saveSession(sess *session.Session) error { } func ProxyImageUrl(c *fiber.Ctx, s string) string { - proxy := GetImageProxy(c) - s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, "https://"+proxy) + proxyOrigin := GetImageProxyOrigin(c) + s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, proxyOrigin) // s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, "/proxy/i.pximg.net") s = strings.ReplaceAll(s, `https:\/\/s.pximg.net`, "/proxy/s.pximg.net") return s } func ProxyImageUrlNoEscape(c *fiber.Ctx, s string) string { - proxy := GetImageProxy(c) - s = strings.ReplaceAll(s, `https://i.pximg.net`, "https://"+proxy) + proxyOrigin := GetImageProxyOrigin(c) + s = strings.ReplaceAll(s, `https://i.pximg.net`, proxyOrigin) // s = strings.ReplaceAll(s, `https:\/\/i.pximg.net`, "/proxy/i.pximg.net") s = strings.ReplaceAll(s, `https://s.pximg.net`, "/proxy/s.pximg.net") return s } -func GetImageProxy(c *fiber.Ctx) string { +func GetImageProxyOrigin(c *fiber.Ctx) string { + return "https://" + GetImageProxyAuthority(c) +} + +// Deprecated: this function should be nuked. +func GetImageProxyAuthority(c *fiber.Ctx) string { sess, err := Store.Get(c) if err != nil { log.Fatalln("Failed to get current session and its values! Falling back to server default!") - return GlobalServerConfig.ProxyServer + return GlobalServerConfig.ProxyServerAuthority } value := sess.Get("ImageProxy") if value != nil { return value.(string) } - return GlobalServerConfig.ProxyServer + return GlobalServerConfig.ProxyServerAuthority } func GetRandomDefaultToken() string { diff --git a/main.go b/main.go index 4f2c88c..61c2594 100644 --- a/main.go +++ b/main.go @@ -2,6 +2,7 @@ package main import ( "errors" + "fmt" "log" "net" "net/http" @@ -130,9 +131,8 @@ func main() { c.Set("X-Content-Type-Options", "nosniff") c.Set("Referrer-Policy", "no-referrer") c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") - // -- Allowing inline styles may be simpler and avoid breakage, but you lose a lot of the protection that CSP provides - // src: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/style-src#unsafe_inline_styles - // c.Set("Content-Security-Policy", "default-src 'none'; script-src 'self' 'sha256-hyWmaJx4D/wwnSlHuylUcUEAHy4waDmxU5jgvi3ilCs='; style-src 'self' 'unsafe-inline'; img-src 'self' https:; connect-src 'self'; frame-ancestors 'self'; object-src 'none'") + c.Set("Content-Security-Policy", fmt.Sprintf("default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; connect-src 'self'", config.GetImageProxyOrigin(c))) + // add this if need iframe: ; frame-ancestors 'self' return c.Next() }) diff --git a/pages/about.go b/pages/about.go index 89a1786..8d82f61 100644 --- a/pages/about.go +++ b/pages/about.go @@ -9,7 +9,7 @@ func AboutPage(c *fiber.Ctx) error { info := fiber.Map{ "Time": core.GlobalServerConfig.StartingTime, "Version": core.GlobalServerConfig.Version, - "ImageProxy": core.GlobalServerConfig.ProxyServer, + "ImageProxy": core.GlobalServerConfig.ProxyServerAuthority, "AcceptLanguage": core.GlobalServerConfig.AcceptLanguage, } return c.Render("pages/about", info) diff --git a/pages/proxy.go b/pages/proxy.go index 1eae583..b29a5dd 100644 --- a/pages/proxy.go +++ b/pages/proxy.go @@ -31,7 +31,7 @@ func SPximgProxy(c *fiber.Ctx) error { } func IPximgProxy(c *fiber.Ctx) error { - proxy_authority := config.GetImageProxy(c) + proxy_authority := config.GetImageProxyAuthority(c) URL := fmt.Sprintf("https://%s/%s", proxy_authority, c.Params("*")) req, _ := http.NewRequest("GET", URL, nil) diff --git a/serve/template.go b/serve/template.go index 4525b34..b75dd91 100644 --- a/serve/template.go +++ b/serve/template.go @@ -252,7 +252,7 @@ func GetTemplateFunctions() template.FuncMap { return s[:len(s)-6] }, "getImageProxyProtocolAuthority": func() string { - return "https://" + config.GlobalServerConfig.ProxyServer + return "https://" + config.GlobalServerConfig.ProxyServerAuthority }, } } diff --git a/spec/quirks.md b/spec/quirks.md new file mode 100644 index 0000000..535f966 --- /dev/null +++ b/spec/quirks.md @@ -0,0 +1,7 @@ +## Why don't my userstyles work? + +Origin: https://codeberg.org/VnPower/PixivFE/pulls/62#issuecomment-1568191 + +This website uses CSP, which blocks the loading of inline styles. In the case of Stylus, you need to enable **Advanced > Circumvent CSP 'style-­src' via adoptedSty­leSheets** in Stylus Options. + +Reference: https://github.com/openstyles/stylus/issues/1685 diff --git a/views/css/style.css b/views/css/style.css index 96291bf..8cbcc17 100644 --- a/views/css/style.css +++ b/views/css/style.css @@ -226,7 +226,7 @@ input[type=submit][hidden] { @keyframes rolling-something { 0% { - background-position-x: 0vm; + background-position-x: 0vw; } 100% { background-position-x: 40vw; diff --git a/views/css/style.scss b/views/css/style.scss index 48cbab8..291a641 100644 --- a/views/css/style.scss +++ b/views/css/style.scss @@ -259,7 +259,7 @@ input[type="submit"][hidden] { @keyframes rolling-something { 0% { - background-position-x: 0vm + background-position-x: 0vw } 100% { background-position-x: 40vw diff --git a/views/js/on-page-load.js b/views/js/on-page-load.js new file mode 100644 index 0000000..51c13ed --- /dev/null +++ b/views/js/on-page-load.js @@ -0,0 +1,17 @@ +// make 4xx 5xx responses swap in as well +addEventListener('htmx:beforeOnLoad', function (event) { + event.detail.shouldSwap = true; + event.detail.isError = false; +}); + +function closeNavigationMenu() { + document.getElementById("sidebar-toggler").checked = false +} +// browser built-in navigation +addEventListener("popstate", (event) => { + closeNavigationMenu() +}); +// htmx triggered navigation +addEventListener("htmx:pushedIntoHistory", (event) => { + closeNavigationMenu() +}); \ No newline at end of file diff --git a/views/layout.jet.html b/views/layout.jet.html index caab4f6..5c11fca 100644 --- a/views/layout.jet.html +++ b/views/layout.jet.html @@ -2,16 +2,17 @@ - - + {{ title := "" }} {{ if isset(Title) }} {{ title = Title }} {{ else }} {{ title = "PixivFE" }} {{ end }} {{ title }} - PixivFE + - + + {{ if BaseURL }} @@ -125,25 +126,7 @@
- +
{{ embed() }}