nocebo/diaspora
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Configure CSP header for services from diaspora.yml

Browse source
This commit is contained in:
Benjamin Neff 2016-09-29 02:43:37 +02:00 committed by Dennis Schubert
parent edf6602099
commit caef670934
No known key found for this signature in database
GPG key ID: 5A0304BEA7966D7E
1 changed files with 23 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

23
config/initializers/secure_headers.rb
View file

@ -17,6 +17,29 @@ SecureHeaders::Configuration.default do |config|
style_src: %w('self' 'unsafe-inline' platform.twitter.com *.twimg.com) style_src: %w('self' 'unsafe-inline' platform.twitter.com *.twimg.com)
} }
if AppConfig.environment.assets.host.present?
asset_host = Addressable::URI.parse(AppConfig.environment.assets.host.get).host
config.csp[:script_src] << asset_host
config.csp[:style_src] << asset_host
end
if AppConfig.chat.enabled?
config.csp[:media_src] << "data:"
unless AppConfig.chat.server.bosh.proxy?
config.csp[:connect_src] << "#{AppConfig.pod_uri.host}:#{AppConfig.chat.server.bosh.port}"
end
end
if AppConfig.privacy.mixpanel_uid.present?
config.csp[:script_src] << "api.mixpanel.com"
config.csp[:connect_src] << "api.mixpanel.com"
end
config.csp[:script_src] << "code.jquery.com" if AppConfig.privacy.jquery_cdn?
config.csp[:script_src] << "static.chartbeat.com" if AppConfig.privacy.chartbeat_uid.present?
config.csp[:form_action] << "www.paypal.com" if AppConfig.settings.paypal_donations.enable?
# Add frame-src but don't spam the log with DEPRECATION warnings. # Add frame-src but don't spam the log with DEPRECATION warnings.
# We need frame-src to support older versions of Chrome, because secure_headers handles all Chrome browsers as # We need frame-src to support older versions of Chrome, because secure_headers handles all Chrome browsers as
# "modern" browser, and ignores the version of the browser. We can drop this once we support only Chrome # "modern" browser, and ignores the version of the browser. We can drop this once we support only Chrome