Skip to content

Commit f86b557

Browse files
EmyrkEmyrk
committed
Comment the proxy csp
1 parent a31072a commit f86b557

File tree

4 files changed

+4
-102
lines changed

4 files changed

+4
-102
lines changed

‎coderd/coderd.go

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -822,7 +822,7 @@ type API struct {
822822
WorkspaceClientCoordinateOverride atomic.Pointer[func(rw http.ResponseWriter) bool]
823823
TailnetCoordinator atomic.Pointer[tailnet.Coordinator]
824824
QuotaCommitter atomic.Pointer[proto.QuotaCommitter]
825-
// HealthyWorkspaceProxyHosts returns the hostnames of healthy workspace proxies
825+
// HealthyWorkspaceProxyHosts returns the hosts of healthy workspace proxies
826826
// for header reasons.
827827
HealthyWorkspaceProxyHosts atomic.Pointer[func() []string]
828828
// TemplateScheduleStore is a pointer to an atomic pointer because this is

‎coderd/httpmw/csp.go

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -98,10 +98,11 @@ func CSPHeaders(websocketHosts func() []string) func(next http.Handler) http.Han
9898
cspSrcs.Append(cspDirectiveConnectSrc, fmt.Sprintf("wss://%[1]s ws://%[1]s", host))
9999
}
100100

101+
// The terminal requires a websocket connection to the workspace proxy.
102+
// Make sure we allow this connection to healthy proxies.
101103
extraConnect := websocketHosts()
102104
if len(extraConnect) > 0 {
103105
for _, extraHost := range extraConnect {
104-
fmt.Println("extraHost", extraHost)
105106
cspSrcs.Append(cspDirectiveConnectSrc, fmt.Sprintf("wss://%[1]s ws://%[1]s", extraHost))
106107
}
107108
}

‎enterprise/coderd/proxyhealth/proxyhealth.go

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,6 @@ func (p *ProxyHealth) storeProxyHealth(statuses map[uuid.UUID]ProxyStatus) {
152152

153153
// Store the statuses in the cache before any other quick values.
154154
p.cache.Store(&statuses)
155-
fmt.Println(healthyHosts)
156155
p.heathyHosts.Store(&healthyHosts)
157156
}
158157

‎site/site.go

Lines changed: 1 addition & 99 deletions
Original file line numberDiff line numberDiff line change
@@ -265,104 +265,6 @@ func (t *htmlTemplates) renderWithState(filePath string, state htmlState) ([]byt
265265
return buf.Bytes(), nil
266266
}
267267

268-
// CSPDirectives is a map of all csp fetch directives to their values.
269-
// Each directive is a set of values that is joined by a space (' ').
270-
// All directives are semi-colon separated as a single string for the csp header.
271-
type CSPDirectives map[CSPFetchDirective][]string
272-
273-
func (s CSPDirectives) Append(d CSPFetchDirective, values ...string) {
274-
if _, ok := s[d]; !ok {
275-
s[d] = make([]string, 0)
276-
}
277-
s[d] = append(s[d], values...)
278-
}
279-
280-
// CSPFetchDirective is the list of all constant fetch directives that
281-
// can be used/appended to.
282-
type CSPFetchDirective string
283-
284-
const (
285-
CSPDirectiveDefaultSrc = "default-src"
286-
CSPDirectiveConnectSrc = "connect-src"
287-
CSPDirectiveChildSrc = "child-src"
288-
CSPDirectiveScriptSrc = "script-src"
289-
CSPDirectiveFontSrc = "font-src"
290-
CSPDirectiveStyleSrc = "style-src"
291-
CSPDirectiveObjectSrc = "object-src"
292-
CSPDirectiveManifestSrc = "manifest-src"
293-
CSPDirectiveFrameSrc = "frame-src"
294-
CSPDirectiveImgSrc = "img-src"
295-
CSPDirectiveReportURI = "report-uri"
296-
CSPDirectiveFormAction = "form-action"
297-
CSPDirectiveMediaSrc = "media-src"
298-
CSPFrameAncestors = "frame-ancestors"
299-
CSPDirectiveWorkerSrc = "worker-src"
300-
)
301-
302-
func cspHeaders(next http.Handler) http.Handler {
303-
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
304-
// Content-Security-Policy disables loading certain content types and can prevent XSS injections.
305-
// This site helps eval your policy for syntax and other common issues: https://csp-evaluator.withgoogle.com/
306-
// If we ever want to render something like a PDF, we need to adjust "object-src"
307-
//
308-
// The list of CSP options: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/default-src
309-
cspSrcs := CSPDirectives{
310-
// All omitted fetch csp srcs default to this.
311-
CSPDirectiveDefaultSrc: {"'self'"},
312-
CSPDirectiveConnectSrc: {"'self'"},
313-
CSPDirectiveChildSrc: {"'self'"},
314-
// https://github.com/suren-atoyan/monaco-react/issues/168
315-
CSPDirectiveScriptSrc: {"'self'"},
316-
CSPDirectiveStyleSrc: {"'self' 'unsafe-inline'"},
317-
// data: is used by monaco editor on FE for Syntax Highlight
318-
CSPDirectiveFontSrc: {"'self' data:"},
319-
CSPDirectiveWorkerSrc: {"'self' blob:"},
320-
// object-src is needed to support code-server
321-
CSPDirectiveObjectSrc: {"'self'"},
322-
// blob: for loading the pwa manifest for code-server
323-
CSPDirectiveManifestSrc: {"'self' blob:"},
324-
CSPDirectiveFrameSrc: {"'self'"},
325-
// data: for loading base64 encoded icons for generic applications.
326-
// https: allows loading images from external sources. This is not ideal
327-
// but is required for the templates page that renders readmes.
328-
// We should find a better solution in the future.
329-
CSPDirectiveImgSrc: {"'self' https: data:"},
330-
CSPDirectiveFormAction: {"'self'"},
331-
CSPDirectiveMediaSrc: {"'self'"},
332-
// Report all violations back to the server to log
333-
CSPDirectiveReportURI: {"/api/v2/csp/reports"},
334-
CSPFrameAncestors: {"'none'"},
335-
336-
// Only scripts can manipulate the dom. This prevents someone from
337-
// naming themselves something like '<svg onload="alert(/cross-site-scripting/)" />'.
338-
// "require-trusted-types-for" : []string{"'script'"},
339-
}
340-
341-
// This extra connect-src addition is required to support old webkit
342-
// based browsers (Safari).
343-
// See issue: https://github.com/w3c/webappsec-csp/issues/7
344-
// Once webkit browsers support 'self' on connect-src, we can remove this.
345-
// When we remove this, the csp header can be static, as opposed to being
346-
// dynamically generated for each request.
347-
host := r.Host
348-
// It is important r.Host is not an empty string.
349-
if host != "" {
350-
// We can add both ws:// and wss:// as browsers do not let https
351-
// pages to connect to non-tls websocket connections. So this
352-
// supports both http & https webpages.
353-
cspSrcs.Append(CSPDirectiveConnectSrc, fmt.Sprintf("wss://%[1]s ws://%[1]s", host))
354-
}
355-
356-
var csp strings.Builder
357-
for src, vals := range cspSrcs {
358-
_, _ = fmt.Fprintf(&csp, "%s %s; ", src, strings.Join(vals, " "))
359-
}
360-
361-
w.Header().Set("Content-Security-Policy", csp.String())
362-
next.ServeHTTP(w, r)
363-
})
364-
}
365-
366268
// secureHeaders is only needed for statically served files. We do not need this for api endpoints.
367269
// It adds various headers to enforce browser security features.
368270
func secureHeaders(next http.Handler) http.Handler {
@@ -394,7 +296,7 @@ func secureHeaders(next http.Handler) http.Handler {
394296

395297
// Prevent the browser from sending Referrer header with requests
396298
ReferrerPolicy: "no-referrer",
397-
}).Handler(cspHeaders(next))
299+
}).Handler(next)
398300
}
399301

400302
// htmlFiles recursively walks the file system passed finding all *.html files.

0 commit comments

Comments
 (0)