From b2f65f33f73b3a978bf391ffc8f8cc40db41d005 Mon Sep 17 00:00:00 2001 From: iacore Date: Wed, 28 Aug 2024 10:09:16 +0000 Subject: [PATCH] move CSP header to only apply to HTML pages --- main.go | 17 ----------------- template/csp.go | 20 ++++++++++++++++++++ template/render.go | 3 +-- 3 files changed, 21 insertions(+), 19 deletions(-) create mode 100644 template/csp.go diff --git a/main.go b/main.go index d381975..e30be32 100644 --- a/main.go +++ b/main.go @@ -25,7 +25,6 @@ import ( "codeberg.org/vnpower/pixivfe/v2/config" "codeberg.org/vnpower/pixivfe/v2/core" "codeberg.org/vnpower/pixivfe/v2/routes" - "codeberg.org/vnpower/pixivfe/v2/session" "codeberg.org/vnpower/pixivfe/v2/template" ) @@ -143,8 +142,6 @@ func main() { start_time := time.Now() - setGlobalHeaders(w, r) - if r.URL.Path != "/" && strings.HasSuffix(r.URL.Path, "/") { // redirect handler: strip trailing / to make router behave url := r.URL @@ -225,20 +222,6 @@ func main() { http.Serve(l, http.HandlerFunc(main_handler)) } -func setGlobalHeaders(w http.ResponseWriter, r *http.Request) { - header := w.Header() - header.Add("Referrer-Policy", "same-origin") // needed for settings redirect - - // headers below are HTML-only - header.Add("X-Frame-Options", "DENY") - // use this if need iframe: `X-Frame-Options: SAMEORIGIN` - header.Add("X-Content-Type-Options", "nosniff") - header.Add("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") - header.Add("Content-Security-Policy", fmt.Sprintf("base-uri 'self'; default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; media-src 'self' %s; connect-src 'self'; form-action 'self'; frame-ancestors 'none';", session.GetImageProxyOrigin(r), session.GetImageProxyOrigin(r))) - // use this if need iframe: `frame-ancestors 'self'` - header.Add("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()") -} - func serveFile(filename string) func(w http.ResponseWriter, r *http.Request) { return func(w http.ResponseWriter, r *http.Request) { http.ServeFile(w, r, filename) } } diff --git a/template/csp.go b/template/csp.go new file mode 100644 index 0000000..f70536b --- /dev/null +++ b/template/csp.go @@ -0,0 +1,20 @@ +package template + +import ( + "fmt" + "net/http" + + "codeberg.org/vnpower/pixivfe/v2/session" +) + +func SetHTMLPrivacyHeaders(w http.ResponseWriter, r *http.Request) { + header := w.Header() + header.Add("Referrer-Policy", "same-origin") // needed for settings redirect + header.Add("X-Frame-Options", "DENY") + // use this if need iframe: `X-Frame-Options: SAMEORIGIN` + header.Add("X-Content-Type-Options", "nosniff") + header.Add("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload") + header.Add("Content-Security-Policy", fmt.Sprintf("base-uri 'self'; default-src 'none'; script-src 'self'; style-src 'self'; img-src 'self' %s; media-src 'self' %s; connect-src 'self'; form-action 'self'; frame-ancestors 'none';", session.GetImageProxyOrigin(r), session.GetImageProxyOrigin(r))) + // use this if need iframe: `frame-ancestors 'self'` + header.Add("Permissions-Policy", "accelerometer=(), ambient-light-sensor=(), battery=(), camera=(), display-capture=(), document-domain=(), encrypted-media=(), execution-while-not-rendered=(), execution-while-out-of-viewport=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), navigation-override=(), payment=(), publickey-credentials-get=(), screen-wake-lock=(), sync-xhr=(), usb=(), web-share=(), xr-spatial-tracking=()") +} diff --git a/template/render.go b/template/render.go index 1ed6499..5a50b0b 100644 --- a/template/render.go +++ b/template/render.go @@ -6,9 +6,7 @@ import ( "net/http" "reflect" "strings" - // "time" - // "codeberg.org/vnpower/pixivfe/v2/config" "codeberg.org/vnpower/pixivfe/v2/session" "codeberg.org/vnpower/pixivfe/v2/utils" @@ -39,6 +37,7 @@ func Render[T any](w http.ResponseWriter, r *http.Request, data T) error { w.Header().Set("content-type", "text/html; charset=utf-8") // todo: think about caching a bit more // w.Header().Set("expires", time.Now().Add(config.ExpiresIn).Format(time.RFC1123)) + SetHTMLPrivacyHeaders(w, r) return RenderInner(w, GetTemplatingVariables(r), data) }