@things-factory/shell 7.0.44 → 7.0.48

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@things-factory/shell",
-  "version": "7.0.44",
+  "version": "7.0.48",
   "description": "Core module for framework",
   "bin": {
     "things-factory": "bin/things-factory",
@@ -133,5 +133,5 @@
     "pg": "^8.7.3",
     "sqlite3": "^5.0.8"
   },
-  "gitHead": "15c3e1b6a2b5f33c03cca37aabdc5f4c388d7dc9"
+  "gitHead": "516772ebee08900790bcc43477419d60adcb4dcd"
 }

package/server/server-dev.ts

@@ -28,6 +28,9 @@ import http from 'http'
 
 import koaWebpack from '@hatiolab/koa-webpack'
 import cors from '@koa/cors'
+
+import crypto from 'crypto'
+
 import { config, loader, logger, orderedModuleNames } from '@things-factory/env'
 import { initLicense, checkValidity } from '@things-factory/operato-license-checker'
 
@@ -118,6 +121,54 @@ const bootstrap = async () => {
     })
   )
 
+  // // Nonce 생성 미들웨어
+  // app.use(async (ctx, next) => {
+  //   const nonce = crypto.randomBytes(16).toString('base64')
+  //   ctx.state.nonce = nonce
+
+  //   const cspDirectives = {
+  //     defaultSrc: ["'self'", `http://localhost:${PORT}`, 'data:'],
+  //     scriptSrc: [
+  //       "'self'",
+  //       `'nonce-${nonce}'`,
+  //       `http://localhost:${PORT}`,
+  //       'https://trusted.cdn.com',
+  //       'https://ajax.googleapis.com',
+  //       'https://www.googletagmanager.com',
+  //       'https://chancejs.com/chance.min.js'
+  //     ],
+  //     connectSrc: [
+  //       "'self'",
+  //       'ws://localhost:*',
+  //       `http://localhost:${PORT}`,
+  //       'https://www.google-analytics.com',
+  //       'data:'
+  //     ],
+  //     fontSrc: ["'self'", `http://localhost:${PORT}`, 'https://fonts.gstatic.com']
+  //   }
+  //   // 개발 모드에서는 'unsafe-eval'을 허용 (비추천)
+  //   cspDirectives.scriptSrc.push("'unsafe-eval'")
+
+  //   await helmet.contentSecurityPolicy({ directives: cspDirectives })(ctx, next)
+  // })
+
+  app.use(async (ctx, next) => {
+    ctx.set('X-Content-Type-Options', 'nosniff')
+
+    const { directives = {} } = config.get('CSP') || {}
+
+    const nonce = crypto.randomBytes(16).toString('base64')
+    ctx.state.nonce = nonce
+
+    const cspHeader = Object.entries(directives as { [key: string]: string[] })
+      .map(([key, value]) => `${key} ${value.join(' ')}`)
+      .join('; ')
+
+    ctx.set('Content-Security-Policy', cspHeader)
+
+    await next()
+  })
+
   var subscriptionMiddleware = []
   process.emit('bootstrap-module-subscription' as any, app, subscriptionMiddleware)
 

package/server/server.ts

@@ -28,6 +28,8 @@ import co from 'co'
 import http from 'http'
 
 import cors from '@koa/cors'
+import crypto from 'crypto'
+
 import { config, loader, logger, orderedModuleNames } from '@things-factory/env'
 import { initLicense, checkValidity } from '@things-factory/operato-license-checker'
 
@@ -95,6 +97,23 @@ const bootstrap = async () => {
     })
   )
 
+  app.use(async (ctx, next) => {
+    ctx.set('X-Content-Type-Options', 'nosniff')
+
+    const { directives = {} } = config.get('CSP') || {}
+
+    const nonce = crypto.randomBytes(16).toString('base64')
+    ctx.state.nonce = nonce
+
+    const cspHeader = Object.entries(directives as { [key: string]: string[] })
+      .map(([key, value]) => `${key} ${value.join(' ')}`)
+      .join('; ')
+
+    ctx.set('Content-Security-Policy', cspHeader)
+
+    await next()
+  })
+
   var subscriptionMiddleware = []
   process.emit('bootstrap-module-subscription' as any, app, subscriptionMiddleware)
 

package/views/dependencies-view-graphviz.html

@@ -2,9 +2,9 @@
 <script src="https://unpkg.com/viz.js@1.8.0/viz.js" type="javascript/worker"></script>
 <script src="https://unpkg.com/d3-graphviz@1.3.1/build/d3-graphviz.min.js"></script>
 
-<div id="graph" style="text-align: center; width: 100%; height: 100%;"></div>
+<div id="graph" style="text-align: center; width: 100%; height: 100%"></div>
 
-<script>
+<script nonce="<%= nonce %>">
     var model = <%- JSON.stringify(model) %>;
 
     var { edges, nodes } = model

package/views/dependencies-view.html

@@ -27,14 +27,18 @@
   text {
     font: 10px sans-serif;
     pointer-events: none;
-    text-shadow: 0 1px 0 #fff, 1px 0 0 #fff, 0 -1px 0 #fff, -1px 0 0 #fff;
+    text-shadow:
+      0 1px 0 #fff,
+      1px 0 0 #fff,
+      0 -1px 0 #fff,
+      -1px 0 0 #fff;
   }
 </style>
 
 <script src="//d3js.org/d3.v3.min.js"></script>
 <script src="//cdn.jsdelivr.net/npm/d3-graphviz@2.6.1/build/d3-graphviz.min.js"></script>
 
-<script>
+<script nonce="<%= nonce %>">
   var model = <%- JSON.stringify(model) %>;
 
   var { edges: links, nodes } = model

package/views/graphql.html

@@ -6,7 +6,7 @@
 
 <div style="width: 100%; height: 100%" id="embedded-sandbox"></div>
 <script src="https://embeddable-sandbox.cdn.apollographql.com/_latest/embeddable-sandbox.umd.production.min.js"></script>
-<script>
+<script nonce="<%= nonce %>">
   new window.EmbeddedSandbox({
     target: '#embedded-sandbox',
     initialEndpoint: '<%- initialEndpoint %>',

package/views/public/home.html

@@ -72,13 +72,7 @@
       }
     </style>
 
-    <script>
-      if ('serviceWorker' in navigator) {
-        navigator.serviceWorker.register('/service-worker.js', {
-          scope: '/'
-        })
-      }
-    </script>
+    <script src="/index.js" defer></script>
 
     <!--- prefetch -->
     <link rel="prefetch" href="/public/home.js" />