github/overleaf
1
0
Fork 0
mirror of https://github.com/overleaf/overleaf.git synced 2024-11-21 20:47:08 -05:00
Code Issues Projects Releases Packages Wiki Activity

Use the full (relative) view path for CSP exclusion (#3916)

Browse source 
GitOrigin-RevId: f6828a447abcc550f0c7dfd0fc6fc72f4b5b1f7e
This commit is contained in:
Alf Eaton 2021-04-16 10:38:12 +01:00 committed by Copybot
parent f7cf7626ec
commit dcd6bd347f
2 changed files with 15 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

13
services/web/app/src/infrastructure/CSP.js
View file

@ -1,4 +1,5 @@
const crypto = require('crypto')
const path = require('path')
module.exports = function ({
reportUri,
@ -10,8 +11,7 @@ module.exports = function ({
const originalRender = res.render
res.render = (...args) => {
// use the view path after removing any prefix up to a "views" folder
const view = args[0].split('/views/').pop()
const view = relativeViewPath(args[0])
// enable the CSP header for a percentage of requests
const belowCutoff = Math.random() * 100 <= percentage
@ -51,3 +51,12 @@ module.exports = function ({
next()
}
}
const webRoot = path.resolve(__dirname, '..', '..', '..')
// build the view path relative to the web root
function relativeViewPath(view) {
return path.isAbsolute(view)
? path.relative(webRoot, view)
: path.join('app', 'views', view)
}

5
services/web/config/settings.defaults.coffee
View file

@ -735,5 +735,8 @@ module.exports = settings =
enabled: process.env.CSP_ENABLED == 'true'
reportOnly: process.env.CSP_REPORT_ONLY == 'true'
reportUri: process.env.CSP_REPORT_URI
exclude: ['project/editor', 'project/list']
exclude: [
'app/views/project/editor',
'app/views/project/list',
]
}