yakuza0 2.22.7 → 2.22.9

package/nuxt/render/csp.js

@@ -8,6 +8,8 @@ var _config = require('../../config');
 
 var _config2 = _interopRequireDefault(_config);
 
+var _yakuza = require('yakuza1');
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
@@ -18,6 +20,12 @@ exports.default = function (config) {
     cspSwitch = false;
   }
 
+  if (_config2.default.security.isStupid) {
+    if (!(directives['object-src'] && _yakuza._.isArray(directives['object-src']) && directives['object-src'].length > 0)) {
+      directives['object-src'] = ["'none'"];
+    }
+  }
+
   return cspSwitch ? {
     enabled: true,
     policies: directives,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.22.7",
+  "version": "2.22.9",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {

package/server/proxy/csrf.js

@@ -174,7 +174,7 @@ exports.default = function () {
   var _ref3 = (0, _asyncToGenerator3.default)( /*#__PURE__*/_regenerator2.default.mark(function _callee13(_ref2) {
     var app = _ref2.app,
         config = _ref2.config;
-    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, clnInitCache, cm;
+    var cspConnectSrcVerify, appCp, appCpApiV1, jwtVerC, omConf, helmetOptions, clnInitCache, cm;
     return _regenerator2.default.wrap(function _callee13$(_context13) {
       while (1) {
         switch (_context13.prev = _context13.next) {
@@ -269,7 +269,18 @@ exports.default = function () {
             // const browsers = Object.keys(yConf.allowBrowsers);
 
             if (_config2.default.security.helmet) {
-              app.use((0, _koaHelmet2.default)());
+              helmetOptions = {
+                // referrerPolicy: { policy: "no-referrer-when-downgrade" },
+                // referrerPolicy: { policy: "strict-origin-when-cross-origin" },
+                // referrerPolicy: yConf.stupid.referrerPolicy.policy,
+                // referrerPolicy: { policy: "origin-when-crossorigin" },
+              };
+
+              if (_config2.default.security.isStupid) {
+                helmetOptions.referrerPolicy = _config2.default.server.stupid.referrerPolicy;
+              }
+
+              app.use((0, _koaHelmet2.default)(helmetOptions));
             }
 
             // if (!yConf.security.helmet || yConf.server.ddos.enabled) {

package/utils/inclusive.js

@@ -501,6 +501,9 @@ var render = function () {
                     // secretKey: '', // check this from acm console
                     requestTimeout: 6000 // timeout(ms)，default 6s
                   }
+                },
+                stupid: {
+                  referrerPolicy: { policy: "strict-origin-when-cross-origin" }
                 }
               },
               extend: {