@abtnode/router-provider 1.16.49-beta-20250828-131156-98768a61 → 1.16.49-beta-20250902-002109-7f238eb8

package/lib/nginx/includes/security/crs4/rules/REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf

@@ -447,3 +447,13 @@ SecRule REQUEST_FILENAME "@contains /discussions/add" \
    chain"
    SecRule REQUEST_METHOD "@pm GET POST PUT" \
        "ctl:ruleEngine=Off"
+
+# Disable header injection for static assets
+SecRule REQUEST_FILENAME "@beginsWith /.blocklet/proxy" \
+   "id:1030,\
+   phase:1,\
+   pass,\
+   nolog,\
+   chain"
+   SecRule REQUEST_METHOD "@pm GET" \
+       "ctl:ruleEngine=Off"

package/lib/nginx/index.js

@@ -895,17 +895,27 @@ class NginxProvider extends BaseProvider {
 
   _ensureDaemonSecurityHeaders() {
     const securityFilePath = path.join(this.includesDir, 'daemon', 'security');
-    const cspSources = [
+
+    const cspImgSources = [
       ...CSP_OFFICIAL_SOURCES,
       ...CSP_SYSTEM_SOURCES,
       ...CSP_THIRD_PARTY_SOURCES,
       ...CSP_ICONIFY_SOURCES,
       'data:',
       'blob:',
+    ];
+    const cspConnectSources = [
+      ...CSP_OFFICIAL_SOURCES,
+      ...CSP_SYSTEM_SOURCES,
+      ...CSP_THIRD_PARTY_SOURCES,
+      ...CSP_ICONIFY_SOURCES,
       '*/__blocklet__.js',
       '*/.well-known/ping',
     ];
-    const cspPolicy = `default-src 'self'; frame-ancestors 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' ${cspSources.join(' ')}; font-src 'self' data:; connect-src 'self' ${cspSources.join(' ')} */.well-known/ping; base-uri 'self'; object-src 'none'`;
+
+    const cspFrameSources = [...CSP_OFFICIAL_SOURCES, ...CSP_SYSTEM_SOURCES];
+
+    const cspPolicy = `default-src 'self'; frame-src 'self' ${cspFrameSources.join(' ')}; frame-ancestors 'self'; script-src 'self' 'unsafe-inline' ${CSP_THIRD_PARTY_SOURCES.join(' ')}; style-src 'self' 'unsafe-inline'; img-src 'self' ${cspImgSources.join(' ')}; font-src 'self' data:; connect-src 'self' ${cspConnectSources.join(' ')} */.well-known/ping; base-uri 'self'; object-src 'none'`;
     const cspLine = `add_header Content-Security-Policy "${cspPolicy}" always;`;
 
     try {
@@ -932,7 +942,7 @@ class NginxProvider extends BaseProvider {
         '# Use "no-referrer" if you want the strictest setting.',
         'add_header Referrer-Policy "strict-origin-when-cross-origin" always;',
         'add_header Permissions-Policy "geolocation=(), microphone=(), camera=(), payment=(), usb=(), bluetooth=(), fullscreen=(), xr-spatial-tracking=(), magnetometer=(), gyroscope=(), accelerometer=(), browsing-topics=()" always;',
-        'add_header X-Frame-Options "DENY" always;',
+        'add_header X-Frame-Options "SAMEORIGIN" always;',
         '# Content-Security-Policy (CSP):',
         '# Mitigates XSS by restricting resource loading.',
         '# This baseline only allows self-hosted resources, blocks framing,',
@@ -1121,6 +1131,9 @@ class NginxProvider extends BaseProvider {
   }) {
     const httpsServerUnit = this._addHttpsServerUnit({ conf, serverName, certificateFileName });
 
+    this._addSecurityHeaders(httpsServerUnit, serviceType);
+    httpsServerUnit._addVerbatimBlock('if ($has_multi_origin)', 'return 400;');
+
     const httpServerUnit = this._addHttpServerUnit({ conf, serverName });
     httpServerUnit._add('return', '307 https://$host$request_uri'); // redirect to https if has https
 

package/lib/nginx/util.js

@@ -217,6 +217,11 @@ real_ip_recursive ${proxyPolicy?.trustRecursive ? 'on' : 'off'};`
       default upgrade;
       '' "";
     }
+    map $http_origin $has_multi_origin {
+      default 0;
+      ~*, 1;
+    }
+
     client_body_temp_path ${path.join(tmpDir, 'client_body')};
     proxy_temp_path ${path.join(tmpDir, 'proxy')};
     fastcgi_temp_path ${path.join(tmpDir, 'fastcgi')};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@abtnode/router-provider",
-  "version": "1.16.49-beta-20250828-131156-98768a61",
+  "version": "1.16.49-beta-20250902-002109-7f238eb8",
   "description": "Routing engine implementations for abt node",
   "author": "polunzh <polunzh@gmail.com>",
   "homepage": "https://github.com/ArcBlock/blocklet-server#readme",
@@ -32,14 +32,14 @@
     "url": "https://github.com/ArcBlock/blocklet-server/issues"
   },
   "dependencies": {
-    "@abtnode/constant": "1.16.49-beta-20250828-131156-98768a61",
-    "@abtnode/db-cache": "1.16.49-beta-20250828-131156-98768a61",
-    "@abtnode/logger": "1.16.49-beta-20250828-131156-98768a61",
-    "@abtnode/router-templates": "1.16.49-beta-20250828-131156-98768a61",
-    "@abtnode/util": "1.16.49-beta-20250828-131156-98768a61",
+    "@abtnode/constant": "1.16.49-beta-20250902-002109-7f238eb8",
+    "@abtnode/db-cache": "1.16.49-beta-20250902-002109-7f238eb8",
+    "@abtnode/logger": "1.16.49-beta-20250902-002109-7f238eb8",
+    "@abtnode/router-templates": "1.16.49-beta-20250902-002109-7f238eb8",
+    "@abtnode/util": "1.16.49-beta-20250902-002109-7f238eb8",
     "@arcblock/http-proxy": "^1.19.1",
     "@arcblock/is-valid-domain": "^1.0.5",
-    "@ocap/util": "^1.23.1",
+    "@ocap/util": "^1.24.3",
     "axios": "^1.7.9",
     "debug": "^4.4.1",
     "fast-glob": "^3.3.2",
@@ -62,5 +62,5 @@
     "bluebird": "^3.7.2",
     "fs-extra": "^11.2.0"
   },
-  "gitHead": "2d2312333cf9dd50034609c678f2fd777e0ba25a"
+  "gitHead": "9bee8945b677d3f490bf3620b71f030a25268aa0"
 }