yakuza0 2.22.7 → 2.22.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/nuxt/render/csp.js +8 -0
- package/package.json +1 -1
- package/server/proxy/csrf.js +4 -1
package/nuxt/render/csp.js
CHANGED
|
@@ -8,6 +8,8 @@ var _config = require('../../config');
|
|
|
8
8
|
|
|
9
9
|
var _config2 = _interopRequireDefault(_config);
|
|
10
10
|
|
|
11
|
+
var _yakuza = require('yakuza1');
|
|
12
|
+
|
|
11
13
|
function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
|
|
12
14
|
|
|
13
15
|
exports.default = function (config) {
|
|
@@ -18,6 +20,12 @@ exports.default = function (config) {
|
|
|
18
20
|
cspSwitch = false;
|
|
19
21
|
}
|
|
20
22
|
|
|
23
|
+
if (_config2.default.security.isStupid) {
|
|
24
|
+
if (!(directives['object-src'] && _yakuza._.isArray(directives['object-src']) && directives['object-src'].length > 0)) {
|
|
25
|
+
directives['object-src'] = ["'none'"];
|
|
26
|
+
}
|
|
27
|
+
}
|
|
28
|
+
|
|
21
29
|
return cspSwitch ? {
|
|
22
30
|
enabled: true,
|
|
23
31
|
policies: directives,
|
package/package.json
CHANGED
package/server/proxy/csrf.js
CHANGED
|
@@ -269,7 +269,10 @@ exports.default = function () {
|
|
|
269
269
|
// const browsers = Object.keys(yConf.allowBrowsers);
|
|
270
270
|
|
|
271
271
|
if (_config2.default.security.helmet) {
|
|
272
|
-
app.use((0, _koaHelmet2.default)(
|
|
272
|
+
app.use((0, _koaHelmet2.default)({
|
|
273
|
+
referrerPolicy: { policy: "no-referrer-when-downgrade" }
|
|
274
|
+
// referrerPolicy: { policy: "origin-when-crossorigin" },
|
|
275
|
+
}));
|
|
273
276
|
}
|
|
274
277
|
|
|
275
278
|
// if (!yConf.security.helmet || yConf.server.ddos.enabled) {
|