From ce1639f8f818b8492322299f2a66e00f4f65bb0e Mon Sep 17 00:00:00 2001 From: ston1th Date: Sun, 20 Mar 2022 22:50:27 +0100 Subject: [PATCH] added CSP --- pkg/fs/fs.go | 6 ------ pkg/srv/srv.go | 44 ++++++++++++++------------------------------ pkg/srv/templates.go | 10 +++++++++- script_hash.sh | 5 +++++ 4 files changed, 28 insertions(+), 37 deletions(-) create mode 100755 script_hash.sh diff --git a/pkg/fs/fs.go b/pkg/fs/fs.go index f8092db..d57f48c 100644 --- a/pkg/fs/fs.go +++ b/pkg/fs/fs.go @@ -109,11 +109,6 @@ func (fs *FS) initMetadata() { } func (fs *FS) Stat(name string) (fi stdfs.FileInfo, err error) { - fi, _, err = fs.StatWithOffline(name) - return -} - -func (fs *FS) StatWithOffline(name string) (fi stdfs.FileInfo, offline bool, err error) { sp, dp := fs.paths(name) fi, err = fs.sc.Get(name) if err == nil { @@ -125,7 +120,6 @@ func (fs *FS) StatWithOffline(name string) (fi stdfs.FileInfo, offline bool, err return } fi, err = os.Stat(dp) - offline = true return } diff --git a/pkg/srv/srv.go b/pkg/srv/srv.go index 2b0c180..dc5c7d7 100644 --- a/pkg/srv/srv.go +++ b/pkg/srv/srv.go @@ -7,9 +7,7 @@ import ( "io" stdfs "io/fs" "net/http" - "os" "path" - "runtime" "strings" "cachefs/pkg/fs" @@ -17,20 +15,11 @@ import ( "github.com/go-logr/logr" ) -func PrintStack() { - os.Stderr.Write(Stack()) -} - -func Stack() []byte { - buf := make([]byte, 1024) - for { - n := runtime.Stack(buf, true) - if n < len(buf) { - return buf[:n] - } - buf = make([]byte, 2*len(buf)) - } -} +const ( + csp = "Content-Security-Policy" + indexCSP = "default-src 'none';style-src 'unsafe-inline';frame-ancestors 'none'" + videoCSP = indexCSP + ";script-src 'sha256-ZLSc/s5/US9uVMMZOJ/yWiS1tj9nEoi+5Qoohy3QetU=';media-src 'self'" +) type FileServer struct { log logr.Logger @@ -69,17 +58,15 @@ func (fs *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) { } p := path.Clean(upath) option := r.FormValue("o") - if option == "debug" { - PrintStack() - } - d, _, err := fs.fs.StatWithOffline(p) + d, err := fs.fs.Stat(p) if err != nil { msg, code := toHTTPError(err) http.Error(w, msg, code) return } - //option := r.FormValue("o") + h := w.Header() if option == "v" { + h.Set(csp, videoCSP) err = video.Execute(w, r.URL.Path) if err != nil { http.Error(w, err.Error(), http.StatusInternalServerError) @@ -110,16 +97,12 @@ func (fs *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) { } i := &responseInterceptor{w: w} - // TODO implement directory listing cache - offline := true - if offline { - r.Header.Del("If-Modified-Since") - r.Header.Del("Cache-Control") - } + r.Header.Del("If-Modified-Since") + r.Header.Del("Cache-Control") fs.h.ServeHTTP(i, r) - if offline { - w.Header().Del("Last-Modified") - } + + h.Del("Last-Modified") + paths, err := i.GetPaths(p, fs.fs) if err == io.EOF { w.WriteHeader(i.Status()) @@ -129,6 +112,7 @@ func (fs *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) { http.Error(w, err.Error(), http.StatusInternalServerError) return } + h.Set(csp, indexCSP) w.WriteHeader(i.Status()) err = index.Execute(w, paths) diff --git a/pkg/srv/templates.go b/pkg/srv/templates.go index 862e297..20d9cf3 100644 --- a/pkg/srv/templates.go +++ b/pkg/srv/templates.go @@ -142,11 +142,19 @@ span { + + cachefs | {{.}} + - + `)) ) diff --git a/script_hash.sh b/script_hash.sh new file mode 100755 index 0000000..6bf8793 --- /dev/null +++ b/script_hash.sh @@ -0,0 +1,5 @@ +#!/bin/bash +echo -n 'sha256-' +echo -n 'document.getElementById("video").volume=0.5;' \ + | openssl sha256 -binary \ + | openssl base64