VnPower/PixivFE
1
0
Fork 0
mirror of https://codeberg.org/VnPower/PixivFE synced 2024-12-06 19:16:23 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity

move CSP header to only apply to HTML pages

Browse Source
This commit is contained in:
iacore
2024-08-28 10:09:16 +00:00
parent 0c2eac81b4
commit b2f65f33f7
3 changed files with 21 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files
main.go
-17
View File
@@ -25,7 +25,6 @@ import (
"codeberg.org/vnpower/pixivfe/v2/config"
"codeberg.org/vnpower/pixivfe/v2/core"
"codeberg.org/vnpower/pixivfe/v2/routes"
"codeberg.org/vnpower/pixivfe/v2/session"
"codeberg.org/vnpower/pixivfe/v2/template"
)
@@ -143,8 +142,6 @@ func main() {
start_time := time.Now()
setGlobalHeaders(w, r)
if r.URL.Path != "/" && strings.HasSuffix(r.URL.Path, "/") {
// redirect handler: strip trailing / to make router behave
url := r.URL
@@ -225,20 +222,6 @@ func main() {
http.Serve(l, http.HandlerFunc(main_handler))
}
func setGlobalHeaders(w http.ResponseWriter, r *http.Request) {
header := w.Header()
header.Add("Referrer-Policy", "same-origin") // needed for settings redirect
// headers below are HTML-only
header.Add("X-Frame-Options", "DENY")
// use this if need iframe: `X-Frame-Options: SAMEORIGIN`
header.Add("X-Content-Type-Options", "nosniff")
header.Add("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
header.Add("Content-Security-Policy", fmt.Sprintf("base-uri 'self'; default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; media-src 'self' %s; connect-src 'self'; form-action 'self'; frame-ancestors 'none';", session.GetImageProxyOrigin(r), session.GetImageProxyOrigin(r)))
// use this if need iframe: `frame-ancestors 'self'`
header.Add("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()")
}
func serveFile(filename string) func(w http.ResponseWriter, r *http.Request) {
return func(w http.ResponseWriter, r *http.Request) { http.ServeFile(w, r, filename) }
}
template/csp.go
+20
View File
@@ -0,0 +1,20 @@
package template
import (
"fmt"
"net/http"
"codeberg.org/vnpower/pixivfe/v2/session"
)
func SetHTMLPrivacyHeaders(w http.ResponseWriter, r *http.Request) {
header := w.Header()
header.Add("Referrer-Policy", "same-origin") // needed for settings redirect
header.Add("X-Frame-Options", "DENY")
// use this if need iframe: `X-Frame-Options: SAMEORIGIN`
header.Add("X-Content-Type-Options", "nosniff")
header.Add("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")
header.Add("Content-Security-Policy", fmt.Sprintf("base-uri 'self'; default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; media-src 'self' %s; connect-src 'self'; form-action 'self'; frame-ancestors 'none';", session.GetImageProxyOrigin(r), session.GetImageProxyOrigin(r)))
// use this if need iframe: `frame-ancestors 'self'`
header.Add("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()")
}
template/render.go
+1 -2
View File
@@ -6,9 +6,7 @@ import (
"net/http"
"reflect"
"strings"
// "time"
// "codeberg.org/vnpower/pixivfe/v2/config"
"codeberg.org/vnpower/pixivfe/v2/session"
"codeberg.org/vnpower/pixivfe/v2/utils"
@@ -39,6 +37,7 @@ func Render[T any](w http.ResponseWriter, r *http.Request, data T) error {
w.Header().Set("content-type", "text/html; charset=utf-8")
// todo: think about caching a bit more
// w.Header().Set("expires", time.Now().Add(config.ExpiresIn).Format(time.RFC1123))
SetHTMLPrivacyHeaders(w, r)
return RenderInner(w, GetTemplatingVariables(r), data)
}