added CSP

pkg/srv/srv.go

@@ -7,9 +7,7 @@ import (
 	"io"
 	stdfs "io/fs"
 	"net/http"
-	"os"
 	"path"
-	"runtime"
 	"strings"
 
 	"cachefs/pkg/fs"
@@ -17,20 +15,11 @@ import (
 	"github.com/go-logr/logr"
 )
 
-func PrintStack() {
-	os.Stderr.Write(Stack())
-}
-
-func Stack() []byte {
-	buf := make([]byte, 1024)
-	for {
-		n := runtime.Stack(buf, true)
-		if n < len(buf) {
-			return buf[:n]
-		}
-		buf = make([]byte, 2*len(buf))
-	}
-}
+const (
+	csp      = "Content-Security-Policy"
+	indexCSP = "default-src 'none';style-src 'unsafe-inline';frame-ancestors 'none'"
+	videoCSP = indexCSP + ";script-src 'sha256-ZLSc/s5/US9uVMMZOJ/yWiS1tj9nEoi+5Qoohy3QetU=';media-src 'self'"
+)
 
 type FileServer struct {
 	log logr.Logger
@@ -69,17 +58,15 @@ func (fs *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 	p := path.Clean(upath)
 	option := r.FormValue("o")
-	if option == "debug" {
-		PrintStack()
-	}
-	d, _, err := fs.fs.StatWithOffline(p)
+	d, err := fs.fs.Stat(p)
 	if err != nil {
 		msg, code := toHTTPError(err)
 		http.Error(w, msg, code)
 		return
 	}
-	//option := r.FormValue("o")
+	h := w.Header()
 	if option == "v" {
+		h.Set(csp, videoCSP)
 		err = video.Execute(w, r.URL.Path)
 		if err != nil {
 			http.Error(w, err.Error(), http.StatusInternalServerError)
@@ -110,16 +97,12 @@ func (fs *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	}
 
 	i := &responseInterceptor{w: w}
-	// TODO implement directory listing cache
-	offline := true
-	if offline {
-		r.Header.Del("If-Modified-Since")
-		r.Header.Del("Cache-Control")
-	}
+	r.Header.Del("If-Modified-Since")
+	r.Header.Del("Cache-Control")
 	fs.h.ServeHTTP(i, r)
-	if offline {
-		w.Header().Del("Last-Modified")
-	}
+
+	h.Del("Last-Modified")
+
 	paths, err := i.GetPaths(p, fs.fs)
 	if err == io.EOF {
 		w.WriteHeader(i.Status())
@@ -129,6 +112,7 @@ func (fs *FileServer) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		http.Error(w, err.Error(), http.StatusInternalServerError)
 		return
 	}
+	h.Set(csp, indexCSP)
 
 	w.WriteHeader(i.Status())
 	err = index.Execute(w, paths)