Initial commit

2022-12-07 04:43:36 +01:00
commit 257f3c354f
496 changed files with 55373 additions and 0 deletions
@@ -0,0 +1,41 @@
+const crypto = require('crypto')
+
+module.exports = {
+  contentSecurityPolicy: {
+    useDefaults: false,
+    directives: {
+      defaultSrc: ["'none'"],
+      objectSrc: ["'none'"],
+      baseUri: ["'none'"],
+      scriptSrc: [
+        generateCspNonce,
+        "'strict-dynamic'",
+        'https:',
+        "'unsafe-inline'"
+      ],
+      connectSrc: ["'self'"],
+      styleSrc: ["'self'", 'https:', "'unsafe-inline'"],
+      fontSrc: ["'self'", 'https:'],
+      imgSrc: ["'self'", 'data:'],
+      // Disabled TT due to jQuery using sink functions and trying to sanitize
+      // produced HTML with DOMPurify breaks functionality of summernote.
+      // requireTrustedTypesFor: ["'script'"],
+      reportUri: ['/api/v1/system/csp-reports']
+    }
+  },
+
+  referrerPolicy: {
+    policy: ['no-referrer', 'strict-origin-when-cross-origin']
+  }
+}
+
+// TODO CSP nonce is generated for every request.
+// It would only really be needed (CSP in general) for the ones which return HTML documents
+// and not for all the other (static) resources (styles, scrips, images, ...)
+// Consider: caching static resources, using hash based policy instead of nonce or other ...
+
+function generateCspNonce(req, res) {
+  const cspNonce = crypto.randomBytes(16).toString('base64')
+  res.locals.cspNonce = cspNonce
+  return `'nonce-${cspNonce}'`
+}