Gandalf/sofarr
1
0
Fork 0
Code Issues 1 Pull Requests Actions 1 Packages Projects Releases 22 Wiki Activity

merge: release/1.0.0 fixes into main
Some checks failed
CI / Security audit (push) Successful in 48s
Details
CI / Tests & coverage (push) Has been cancelled
Details

Browse Source
This commit is contained in:
Gronod
2026-05-17 09:38:11 +01:00
parent c86694fc8f c3ae3a80de
commit f5ef2c5991
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
server/app.js
View File

@@ -50,7 +50,7 @@ function createApp({ skipRateLimits = false } = {}) {
baseUri: ["'self'"], baseUri: ["'self'"],
frameAncestors: ["'none'"], frameAncestors: ["'none'"],
formAction: ["'self'"], formAction: ["'self'"],
upgradeInsecureRequests: process.env.NODE_ENV === 'production' ? [] : null upgradeInsecureRequests: process.env.TRUST_PROXY ? [] : null
} }
}, },
hsts: { maxAge: 31536000, includeSubDomains: true, preload: true }, hsts: { maxAge: 31536000, includeSubDomains: true, preload: true },

12
server/index.js
View File

@@ -137,7 +137,7 @@ app.use((req, res, next) => {
baseUri: ["'self'"], baseUri: ["'self'"],
frameAncestors: ["'none'"], frameAncestors: ["'none'"],
formAction: ["'self'"], formAction: ["'self'"],
upgradeInsecureRequests: process.env.NODE_ENV === 'production' ? [] : null upgradeInsecureRequests: process.env.TRUST_PROXY ? [] : null
} }
}, },
hsts: { hsts: {
@@ -214,15 +214,17 @@ app.use(express.static(PUBLIC_DIR, {
} }
})); }));
// Serve index.html with nonce injected into the <script> and <link> tags // Serve index.html with CSP nonce injected into <script> tags
function serveIndex(req, res) { function serveIndex(req, res) {
fs.readFile(INDEX_HTML, 'utf8', (err, html) => { fs.readFile(INDEX_HTML, 'utf8', (err, html) => {
if (err) return res.status(500).send('Internal Server Error'); if (err) return res.status(500).send('Internal Server Error');
const nonce = res.locals.cspNonce; const nonce = res.locals.cspNonce;
// Inject nonce into <script> and <link rel="stylesheet"> tags // Only inject nonce into <script> tags — style-src 'self' already permits
// same-origin <link rel=stylesheet> without a nonce, and injecting a nonce
// onto <link> breaks mobile browsers / caching proxies (stale HTML carries
// the old nonce which no longer matches the per-request CSP header).
const patched = html const patched = html
.replace(/<script([^>]*)>/gi, `<script nonce="${nonce}"$1>`) .replace(/<script([^>]*)>/gi, `<script nonce="${nonce}"$1>`);
.replace(/<link([^>]*rel=["']stylesheet["'][^>]*)>/gi, `<link nonce="${nonce}"$1>`);
res.setHeader('Content-Type', 'text/html; charset=utf-8'); res.setHeader('Content-Type', 'text/html; charset=utf-8');
res.send(patched); res.send(patched);
}); });