kotovalexarian-likes-github/mperham--sidekiq
1
0
Fork 0
mirror of https://github.com/mperham/sidekiq.git synced 2022-11-09 13:52:34 -05:00
Code Releases Activity

Add CSP header to web admin to ensure it matches needs (#3913)

Browse source
This commit is contained in:
Jesse Reiss 2018-08-05 12:31:37 -07:00 • committed by Mike Perham
parent 778b9cf82f
commit e339d23036
2 changed files with 25 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

16
lib/sidekiq/web/application.rb
View file

@ -7,6 +7,21 @@ module Sidekiq
CONTENT_LENGTH = "Content-Length" CONTENT_LENGTH = "Content-Length"
CONTENT_TYPE = "Content-Type" CONTENT_TYPE = "Content-Type"
REDIS_KEYS = %w(redis_version uptime_in_days connected_clients used_memory_human used_memory_peak_human) REDIS_KEYS = %w(redis_version uptime_in_days connected_clients used_memory_human used_memory_peak_human)
CSP_HEADER = [
"default-src 'self' https: http:",
"child-src 'self'",
"connect-src 'self' https: http: wss: ws:",
"font-src 'self' https: http:",
"frame-src 'self'",
"img-src 'self' https: http: data:",
"manifest-src 'self'",
"media-src 'self'",
"object-src 'none'",
"script-src 'self' https: http:",
"style-src 'self' https: http: 'unsafe-inline'",
"worker-src 'self'",
"base-uri 'self'"
].join('; ').freeze
def initialize(klass) def initialize(klass)
@klass = klass @klass = klass
@ -279,6 +294,7 @@ module Sidekiq
"Content-Type" => "text/html", "Content-Type" => "text/html",
"Cache-Control" => "no-cache", "Cache-Control" => "no-cache",
"Content-Language" => action.locale, "Content-Language" => action.locale,
"Content-Security-Policy" => CSP_HEADER
} }
[200, headers, [resp]] [200, headers, [resp]]

9
test/test_web.rb
View file

@ -54,6 +54,15 @@ class TestWeb < Sidekiq::Test
assert_match(/Oversikt/, last_response.body) assert_match(/Oversikt/, last_response.body)
end end
it 'can provide a default, appropriate CSP for its content' do
get '/', {}
policies = last_response.headers["Content-Security-Policy"].split('; ')
assert_includes(policies, "connect-src 'self' https: http: wss: ws:")
assert_includes(policies, "style-src 'self' https: http: 'unsafe-inline'")
assert_includes(policies, "script-src 'self' https: http:")
assert_includes(policies, "object-src 'none'")
end
describe 'busy' do describe 'busy' do
it 'can display workers' do it 'can display workers' do