ae7b652463
* Create a storybook with callout component * Add to dist/storybook * Remove references to dist dir, storybook takes place * Update Callout.stories.tsx * Update Dockerfile * Update Dockerfile
80 lines
2.5 KiB
JavaScript
80 lines
2.5 KiB
JavaScript
import helmet from 'helmet'
|
|
import isArchivedVersion from '../lib/is-archived-version.js'
|
|
import versionSatisfiesRange from '../lib/version-satisfies-range.js'
|
|
// This module defines a Content Security Policy (CSP) to disallow
|
|
// inline scripts and content from untrusted sources.
|
|
|
|
const { contentSecurityPolicy } = helmet
|
|
|
|
const AZURE_STORAGE_URL = 'githubdocs.azureedge.net'
|
|
|
|
export default function csp(req, res, next) {
|
|
const csp = {
|
|
directives: {
|
|
defaultSrc: ["'none'"],
|
|
connectSrc: ["'self'"],
|
|
fontSrc: ["'self'", 'data:', AZURE_STORAGE_URL],
|
|
imgSrc: [
|
|
"'self'",
|
|
'data:',
|
|
'github.githubassets.com',
|
|
AZURE_STORAGE_URL,
|
|
'placehold.it',
|
|
'*.githubusercontent.com',
|
|
'github.com',
|
|
],
|
|
objectSrc: ["'self'"],
|
|
scriptSrc: [
|
|
"'self'",
|
|
'data:',
|
|
// For use during development only! This allows us to use a performant webpack devtool setting (eval)
|
|
// https://webpack.js.org/configuration/devtool/#devtool
|
|
process.env.NODE_ENV === 'development' && "'unsafe-eval'",
|
|
].filter(Boolean),
|
|
frameSrc: [
|
|
// exceptions for GraphQL Explorer
|
|
'https://graphql-explorer.githubapp.com', // production env
|
|
'https://graphql.github.com/',
|
|
'http://localhost:3000', // development env
|
|
'https://www.youtube-nocookie.com',
|
|
],
|
|
styleSrc: ["'self'", "'unsafe-inline'"],
|
|
childSrc: [
|
|
"'self'", // exception for search in deprecated GHE versions
|
|
],
|
|
},
|
|
}
|
|
|
|
const { requestedVersion } = isArchivedVersion(req)
|
|
|
|
// Exception for deprecated Enterprise docs (Node.js era)
|
|
if (
|
|
versionSatisfiesRange(requestedVersion, '<=2.19') &&
|
|
versionSatisfiesRange(requestedVersion, '>2.12')
|
|
) {
|
|
csp.directives.scriptSrc.push(
|
|
"'unsafe-eval'",
|
|
"'unsafe-inline'",
|
|
'http://www.google-analytics.com',
|
|
'https://ssl.google-analytics.com'
|
|
)
|
|
csp.directives.connectSrc.push('https://www.google-analytics.com')
|
|
csp.directives.imgSrc.push(
|
|
'http://www.google-analytics.com',
|
|
'https://ssl.google-analytics.com'
|
|
)
|
|
}
|
|
|
|
// Exception for search in deprecated Enterprise docs <=2.12 (static site era)
|
|
if (versionSatisfiesRange(requestedVersion, '<=2.12')) {
|
|
csp.directives.scriptSrc.push("'unsafe-inline'")
|
|
}
|
|
|
|
if (req.path.startsWith('/storybook')) {
|
|
csp.directives.scriptSrc.push("'unsafe-eval'", "'unsafe-inline'")
|
|
csp.directives.frameSrc.push("'self'")
|
|
}
|
|
|
|
return contentSecurityPolicy(csp)(req, res, next)
|
|
}
|