cory/tildefriends
4
5
Fork 1
Code Issues 33 Pull Requests 1 Actions Releases 27 Wiki Activity

Today I discovered the "Content-Security-Policy: sandbox" header.

Browse Source 
git-svn-id: https://www.unprompted.com/svn/projects/tildefriends/trunk@4298 ed5197a5-7fde-0310-b194-c3ffbd925b24
This commit is contained in:
Cory McWilliams 2023-05-14 19:46:01 +00:00
parent c807e21c6b
commit 5b8bdbb3e4
1 changed files with 25 additions and 45 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

70
core/core.js
View File

@ -16,13 +16,6 @@ const k_mime_types = {
'svg': 'image/svg+xml', 'svg': 'image/svg+xml',
}; };
const k_mime_type_is_trusted = {
'application/json': true,
'text/css': true,
'text/javascript': true,
'text/json': true,
};
const k_magic_bytes = [ const k_magic_bytes = [
{bytes: [0xff, 0xd8, 0xff, 0xdb], type: 'image/jpeg'}, {bytes: [0xff, 0xd8, 0xff, 0xdb], type: 'image/jpeg'},
{bytes: [0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46, 0x00, 0x01], type: 'image/jpeg'}, {bytes: [0xff, 0xd8, 0xff, 0xe0, 0x00, 0x10, 0x4a, 0x46, 0x49, 0x46, 0x00, 0x01], type: 'image/jpeg'},
@ -573,13 +566,6 @@ function guessTypeFromMagicBytes(data) {
} }
} }
function guessTypeUntrusted(path, data) {
let type = guessTypeFromMagicBytes(data) || guessTypeFromName(path);
if (k_mime_type_is_trusted[type]) {
return type;
}
}
function sendData(response, data, type, headers) { function sendData(response, data, type, headers) {
if (data) { if (data) {
response.writeHead(200, Object.assign({"Content-Type": type || guessTypeFromMagicBytes(data) || "application/binary", "Content-Length": data.byteLength}, headers || {})); response.writeHead(200, Object.assign({"Content-Type": type || guessTypeFromMagicBytes(data) || "application/binary", "Content-Length": data.byteLength}, headers || {}));
@ -742,44 +728,38 @@ async function blobHandler(request, response, blobId, uri) {
response.end('OK'); response.end('OK');
} else { } else {
let data; let data;
let type;
let headers;
let match; let match;
let id;
if (match = /^\/\~(\w+)\/(\w+)$/.exec(blobId)) { if (match = /^\/\~(\w+)\/(\w+)$/.exec(blobId)) {
let db = new Database(match[1]); let db = new Database(match[1]);
let id = await db.get('path:' + match[2]); let app_id = await db.get('path:' + match[2]);
if (id) { let app_object = JSON.parse(utf8Decode(await getBlobOrContent(app_id)));
if (request.headers['if-none-match'] && request.headers['if-none-match'] == '"' + id + '"') { id = app_object.files[uri.substring(1)];
headers = { } else {
'Access-Control-Allow-Origin': '*', let app_object = JSON.parse(utf8Decode(await getBlobOrContent(blobId)));
}; id = app_object.files[uri.substring(1)];
response.writeHead(304, headers); }
response.end();
} else { if (id) {
data = utf8Decode(await getBlobOrContent(id)); if (request.headers['if-none-match'] && request.headers['if-none-match'] == '"' + id + '"') {
let appObject = JSON.parse(data); let headers = {
data = appObject.files[uri.substring(1)]; 'Access-Control-Allow-Origin': '*',
data = await getBlobOrContent(data); 'Content-Security-Policy': 'sandbox',
type = guessTypeUntrusted(uri, data); };
headers = { response.writeHead(304, headers);
'ETag': '"' + id + '"', response.end();
'Access-Control-Allow-Origin': '*',
};
sendData(response, data, type, headers);
}
} else { } else {
let headers = {
'ETag': '"' + id + '"',
'Access-Control-Allow-Origin': '*',
'Content-Security-Policy': 'sandbox',
};
data = await getBlobOrContent(id);
let type = guessTypeFromName(uri) || guessTypeFromMagicBytes(data);
sendData(response, data, type, headers); sendData(response, data, type, headers);
} }
} else { } else {
data = utf8Decode(await getBlobOrContent(blobId)); sendData(response, data, type, {});
let appObject = JSON.parse(data);
data = appObject.files[uri.substring(1)];
data = await getBlobOrContent(data);
headers = {
'Access-Control-Allow-Origin': '*',
};
type = guessTypeUntrusted(uri, data);
sendData(response, data, type, headers);
} }
} }
} }