mirror of
https://github.com/penpot/penpot.git
synced 2026-09-19 02:16:14 +00:00
1e8acbb2db
The frontend build now emits the sha256 hashes of the inline scripts of every page it writes into resources/public, the image moves them out of the document root, and the entrypoint splices them into the default script-src. This removes one of the two reasons why enforcing mode was not usable. The hashes are computed on the rendered output rather than on the mustache templates, since the digest covers the exact bytes served between the script tags. All four served pages contribute, not just index.html: challenge.html handles the redirect, render.html is loaded by the exporter in a headless browser, and rasterizer.html is initialised by the frontend itself, so leaving any of them out would have broken those paths under enforcing mode. The storybook previews are excluded because that container does not serve them. A bundle predating this change yields no hashes and the policy stays as it was, so older bundles keep building. The three external locations were also passing through the security headers of their upstreams. raw.githubusercontent.com returns its own Content-Security-Policy and both it and fonts.googleapis.com return Strict-Transport-Security. Browsers enforce the intersection of every policy they receive, so the upstream one takes precedence on those responses, and the HSTS one lands on our own host, meaning a deployment that deliberately disables HSTS would get it set anyway by a third party. Hide all three at the proxy. Signed-off-by: David Barragán Merino <david.barragan@kaleidos.net>
84 lines
3.4 KiB
Plaintext
84 lines
3.4 KiB
Plaintext
location ~ ^/github/penpot-files/(.+)$ {
|
|
rewrite ^/github/penpot-files/(.+) /penpot/penpot-files/refs/heads/main/$1 break;
|
|
proxy_pass https://raw.githubusercontent.com;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cookies;
|
|
proxy_set_header User-Agent "curl/8.5.0";
|
|
proxy_set_header Host "raw.githubusercontent.com";
|
|
proxy_set_header Accept "*/*";
|
|
# A third-party upstream must not dictate the security policy of our own
|
|
# origin: browsers enforce the intersection of every Content-Security-Policy
|
|
# they receive, and any Strict-Transport-Security lands on this host.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header Content-Security-Policy-Report-Only;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
proxy_buffering off;
|
|
}
|
|
|
|
location ~ ^/internal/gfonts/font/(?<font_file>.+) {
|
|
proxy_pass https://fonts.gstatic.com/s/$font_file;
|
|
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cross-Origin-Resource-Policy;
|
|
proxy_hide_header Link;
|
|
proxy_hide_header Alt-Svc;
|
|
proxy_hide_header Cache-Control;
|
|
proxy_hide_header Expires;
|
|
proxy_hide_header Cross-Origin-Opener-Policy;
|
|
proxy_hide_header Report-To;
|
|
|
|
proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;
|
|
|
|
proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
|
|
proxy_set_header Host "fonts.gstatic.com";
|
|
proxy_set_header Accept "*/*";
|
|
|
|
proxy_cache penpot;
|
|
|
|
# A third-party upstream must not dictate the security policy of our own
|
|
# origin: browsers enforce the intersection of every Content-Security-Policy
|
|
# they receive, and any Strict-Transport-Security lands on this host.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header Content-Security-Policy-Report-Only;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
add_header Cache-Control max-age=86400;
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|
|
|
|
location ~ ^/internal/gfonts/css {
|
|
proxy_pass https://fonts.googleapis.com/css?$args;
|
|
proxy_hide_header Access-Control-Allow-Origin;
|
|
proxy_hide_header Cross-Origin-Resource-Policy;
|
|
proxy_hide_header Link;
|
|
proxy_hide_header Alt-Svc;
|
|
proxy_hide_header Cache-Control;
|
|
proxy_hide_header Expires;
|
|
|
|
proxy_ignore_headers Set-Cookie Vary Cache-Control Expires;
|
|
|
|
proxy_set_header User-Agent "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/113.0.0.0 Safari/537.36";
|
|
proxy_set_header Host "fonts.googleapis.com";
|
|
proxy_set_header Accept "*/*";
|
|
|
|
proxy_cache penpot;
|
|
|
|
# A third-party upstream must not dictate the security policy of our own
|
|
# origin: browsers enforce the intersection of every Content-Security-Policy
|
|
# they receive, and any Strict-Transport-Security lands on this host.
|
|
proxy_hide_header Strict-Transport-Security;
|
|
proxy_hide_header Content-Security-Policy;
|
|
proxy_hide_header Content-Security-Policy-Report-Only;
|
|
|
|
include /etc/nginx/nginx-security-headers.conf;
|
|
add_header Access-Control-Allow-Origin $http_origin;
|
|
add_header Cache-Control max-age=86400;
|
|
add_header X-Cache-Status $upstream_cache_status;
|
|
}
|