natty
/
fox-send
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge branch 'iomintz-master-patch-75995' into 'master' 

CSP: remove a bunch of unused mozilla-only domains and FXA domains

See merge request timvisee/send!7
This commit is contained in:
Tim Visée 2020-11-13 23:26:51 +00:00
parent d305e7fd57 44c03e355f
commit 62809fb57d
1 changed files with 0 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
server/routes/index.js
View File

@ -36,19 +36,10 @@ module.exports = function(app) {
defaultSrc: ["'self'"], defaultSrc: ["'self'"],
connectSrc: [ connectSrc: [
"'self'", "'self'",
'wss://*.dev.lcip.org',
'wss://*.send.nonprod.cloudops.mozgcp.net',
config.base_url.replace(/^https:\/\//, 'wss://'), config.base_url.replace(/^https:\/\//, 'wss://'),
'https://*.dev.lcip.org',
'https://accounts.firefox.com',
'https://*.accounts.firefox.com',
'https://sentry.prod.mozaws.net'
], ],
imgSrc: [ imgSrc: [
"'self'", "'self'",
'https://*.dev.lcip.org',
'https://firefoxusercontent.com',
'https://secure.gravatar.com'
], ],
scriptSrc: [ scriptSrc: [
"'self'", "'self'",
@ -66,18 +57,6 @@ module.exports = function(app) {
csp.directives.connectSrc.push( csp.directives.connectSrc.push(
config.base_url.replace(/^https:\/\//, 'wss://') config.base_url.replace(/^https:\/\//, 'wss://')
); );
if (config.fxa_csp_oauth_url != '') {
csp.directives.connectSrc.push(config.fxa_csp_oauth_url);
}
if (config.fxa_csp_content_url != '') {
csp.directives.connectSrc.push(config.fxa_csp_content_url);
}
if (config.fxa_csp_profile_url != '') {
csp.directives.connectSrc.push(config.fxa_csp_profile_url);
}
if (config.fxa_csp_profileimage_url != '') {
csp.directives.imgSrc.push(config.fxa_csp_profileimage_url);
}
app.use(helmet.contentSecurityPolicy(csp)); app.use(helmet.contentSecurityPolicy(csp));
} }