github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2025-03-03 20:15:17 +00:00
Code Issues Projects Releases Packages Wiki Activity

Add style-src directive to CSP for binary template PDF output (#14573)

Browse source 
GitOrigin-RevId: c4a93af0a3dad8accbe2655c2323f2d14cc8e551
This commit is contained in:
Alf Eaton 2023-09-01 12:04:21 +01:00 committed by Copybot
parent 3bbce358c6
commit 5aeb461551
1 changed files with 17 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

18
services/web/app/src/infrastructure/CSP.js
View file

@ -47,7 +47,7 @@ module.exports = function ({
} }
} }
const buildDefaultPolicy = reportUri => { const buildDefaultPolicy = (reportUri, styleSrc) => {
const directives = [ const directives = [
`base-uri 'none'`, // forbid setting a "base" element `base-uri 'none'`, // forbid setting a "base" element
`default-src 'none'`, // forbid loading anything from a "src" attribute `default-src 'none'`, // forbid loading anything from a "src" attribute
@ -61,6 +61,10 @@ const buildDefaultPolicy = reportUri => {
// NOTE: implement report-to once it's more widely supported // NOTE: implement report-to once it's more widely supported
} }
if (styleSrc) {
directives.push(`style-src ${styleSrc}`)
}
return directives.join('; ') return directives.join('; ')
} }
@ -98,5 +102,17 @@ function removeCSPHeaders(res) {
res.removeHeader('Content-Security-Policy-Report-Only') res.removeHeader('Content-Security-Policy-Report-Only')
} }
/**
* WARNING: allowing inline styles can open a security hole;
* this is intended only for use in specific circumstances, such as Safari's built-in PDF viewer.
*/
function allowUnsafeInlineStyles(res) {
res.set(
'Content-Security-Policy',
buildDefaultPolicy(undefined, "'unsafe-inline'")
)
}
module.exports.buildDefaultPolicy = buildDefaultPolicy module.exports.buildDefaultPolicy = buildDefaultPolicy
module.exports.removeCSPHeaders = removeCSPHeaders module.exports.removeCSPHeaders = removeCSPHeaders
module.exports.allowUnsafeInlineStyles = allowUnsafeInlineStyles