@ferrule-io/ok-fine 0.3.8 → 0.3.9

package/dist/http/ui.js

@@ -17,6 +17,9 @@ const CONTENT_TYPES = {
     ".txt": "text/plain; charset=utf-8",
 };
 const IMMUTABLE = "public, max-age=31536000, immutable";
+const PERMISSIONS_POLICY = "camera=(), display-capture=(), geolocation=(), microphone=()";
+const SVG_CSP = "default-src 'none'; style-src 'unsafe-inline'; sandbox";
+const DEFAULT_CSP = "frame-ancestors 'none'";
 /** Unique origins of the string http(s) URLs among `endpoints`; ignores anything else. */
 export function endpointOrigins(...endpoints) {
     const origins = new Set();
@@ -67,50 +70,61 @@ export async function registerUiRoutes(app, options) {
         app.log.warn({ dir: options.dir }, "web UI assets not found; /ui disabled");
         return false;
     }
-    const csp = [
+    const htmlCsp = [
         "default-src 'self'",
         "script-src 'self'",
-        // Shiki emits inline style attributes.
+        // Shiki emits inline style attributes for code block syntax highlighting.
         "style-src 'self' 'unsafe-inline'",
-        "img-src 'self' data: https:",
+        "img-src 'self' data:",
         "font-src 'self' data:",
         `connect-src 'self'${options.connectSrc.map((origin) => ` ${origin}`).join("")}`,
         "object-src 'none'",
         "base-uri 'none'",
         "form-action 'none'",
         "frame-ancestors 'none'",
+        ...(options.publicBaseUrl.startsWith("https://") ? ["upgrade-insecure-requests"] : []),
     ].join("; ");
-    const sendHtml = (reply) => reply
-        .header("content-type", "text/html; charset=utf-8")
-        .header("cache-control", "no-cache")
-        .header("referrer-policy", "no-referrer")
-        .header("x-frame-options", "DENY")
-        .header("x-content-type-options", "nosniff")
-        .header("content-security-policy", csp)
-        .send(index.body);
-    app.get("/", async (_req, reply) => reply.redirect("/ui/", 302));
-    app.get("/ui", async (_req, reply) => reply.redirect("/ui/", 301));
-    app.get("/ui/config.json", async (_req, reply) => reply.header("cache-control", "no-store").header("x-content-type-options", "nosniff").send(options.clientConfig));
-    app.get("/ui/*", async (req, reply) => {
-        const rel = req.params["*"];
-        if (rel === "" || rel === "index.html")
+    await app.register(async (ui) => {
+        ui.addHook("onSend", async (_req, reply, payload) => {
+            reply.header("x-content-type-options", "nosniff");
+            reply.header("x-frame-options", "DENY");
+            reply.header("referrer-policy", "no-referrer");
+            reply.header("cross-origin-opener-policy", "same-origin");
+            reply.header("permissions-policy", PERMISSIONS_POLICY);
+            const contentType = reply.getHeader("content-type");
+            if (typeof contentType === "string" && contentType.startsWith("image/svg+xml")) {
+                reply.header("content-security-policy", SVG_CSP);
+            }
+            else if (!reply.hasHeader("content-security-policy")) {
+                reply.header("content-security-policy", DEFAULT_CSP);
+            }
+            return payload;
+        });
+        const sendHtml = (reply) => reply
+            .header("content-type", "text/html; charset=utf-8")
+            .header("cache-control", "no-cache")
+            .header("content-security-policy", htmlCsp)
+            .send(index.body);
+        ui.get("/", async (_req, reply) => reply.redirect("/ui/", 302));
+        ui.get("/ui", async (_req, reply) => reply.redirect("/ui/", 301));
+        ui.get("/ui/config.json", async (_req, reply) => reply.header("cache-control", "no-store").send(options.clientConfig));
+        ui.get("/ui/*", async (req, reply) => {
+            const rel = req.params["*"];
+            if (rel === "" || rel === "index.html")
+                return sendHtml(reply);
+            const asset = assets.get(rel);
+            if (asset) {
+                return reply.header("content-type", asset.type).header("cache-control", asset.cache).send(asset.body);
+            }
+            const last = rel.slice(rel.lastIndexOf("/") + 1);
+            if (/\.[A-Za-z0-9]+$/.test(last)) {
+                return reply
+                    .code(404)
+                    .header("cache-control", "no-cache")
+                    .send({ error: { code: "not_found", message: "not found" } });
+            }
             return sendHtml(reply);
-        const asset = assets.get(rel);
-        if (asset) {
-            return reply
-                .header("content-type", asset.type)
-                .header("cache-control", asset.cache)
-                .header("x-content-type-options", "nosniff")
-                .send(asset.body);
-        }
-        const last = rel.slice(rel.lastIndexOf("/") + 1);
-        if (/\.[A-Za-z0-9]+$/.test(last)) {
-            return reply
-                .code(404)
-                .header("x-content-type-options", "nosniff")
-                .send({ error: { code: "not_found", message: "not found" } });
-        }
-        return sendHtml(reply);
+        });
     });
     app.log.info({ url: `${options.publicBaseUrl}/ui/` }, "web UI enabled");
     return true;

package/dist/server.js

@@ -150,7 +150,10 @@ export async function startServer(config, options = {}) {
             }
             const host = parseHostHeader(req.headers.host);
             if (!host || !allowedHosts[host]) {
-                return reply.code(403).send({
+                return reply
+                    .code(403)
+                    .header("x-content-type-options", "nosniff")
+                    .send({
                     error: {
                         code: "forbidden",
                         message: `Host header '${req.headers.host ?? ""}' is not allowed in AUTH_MODE=none`,
@@ -173,7 +176,10 @@ export async function startServer(config, options = {}) {
                     }
                 }
                 if (!originAllowed) {
-                    return reply.code(403).send({
+                    return reply
+                        .code(403)
+                        .header("x-content-type-options", "nosniff")
+                        .send({
                         error: {
                             code: "forbidden",
                             message: `Origin '${rawOrigin ?? ""}' is not allowed in AUTH_MODE=none`,