LogalDeveloper/owncast
LogalDeveloper/owncast
0
Fork 0
Code

Explicitly add unsafe-eval only when running automated browser tests

Browse Source
This commit is contained in:
Gabe Kangas 2021-09-18 10:06:47 -07:00
parent cc6b257470
commit e81d41d092
2 changed files with 11 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
router/middleware/headers.go
View File

@ -1,7 +1,9 @@
package middleware package middleware
import ( import (
"fmt"
"net/http" "net/http"
"os"
"strings" "strings"
) )
@ -10,9 +12,16 @@ func SetHeaders(w http.ResponseWriter) {
// Tell Google to not use this response in their FLoC tracking. // Tell Google to not use this response in their FLoC tracking.
w.Header().Set("Permissions-Policy", "interest-cohort=()") w.Header().Set("Permissions-Policy", "interest-cohort=()")
// When running automated browser tests we must allow `unsafe-eval` in our CSP
// so we can explicitly add it only when needed.
inTest := os.Getenv("BROWSER_TEST") == "true"
unsafeEval := ""
if inTest {
unsafeEval = `'unsafe-eval'`
}
// Content security policy // Content security policy
csp := []string{ csp := []string{
"script-src 'self' 'unsafe-eval' 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY=' 'sha256-qYEKg5UMg/KbbMBkyPIGsxtkfn/safeLBT08DK3592g=' 'sha256-2erOadwY1DsoNdxVjGlxldMJrFEUzr5sLDdB8lmm9m8=' 'sha256-DgrU+KwEGMFcB8B2ZdQyuxWWvTm7LeGpc+8SkxbSxGA='", fmt.Sprintf("script-src 'self' %s 'sha256-2HPCfJIJHnY0NrRDPTOdC7AOSJIcQyNxzUuut3TsYRY=' 'sha256-qYEKg5UMg/KbbMBkyPIGsxtkfn/safeLBT08DK3592g=' 'sha256-2erOadwY1DsoNdxVjGlxldMJrFEUzr5sLDdB8lmm9m8=' 'sha256-DgrU+KwEGMFcB8B2ZdQyuxWWvTm7LeGpc+8SkxbSxGA='", unsafeEval),
"worker-src 'self' blob:", // No single quotes around blob: "worker-src 'self' blob:", // No single quotes around blob:
} }
w.Header().Set("Content-Security-Policy", strings.Join(csp, "; ")) w.Header().Set("Content-Security-Policy", strings.Join(csp, "; "))

2
test/automated/browser/run.sh
View File

@ -19,7 +19,7 @@ pushd ../../.. > /dev/null
# Build and run owncast from source # Build and run owncast from source
go build -o owncast main.go pkged.go go build -o owncast main.go pkged.go
./owncast -rtmpport 9021 -webserverport 5309 -database $TEMP_DB & BROWSER_TEST=true ./owncast -rtmpport 9021 -webserverport 5309 -database $TEMP_DB &
SERVER_PID=$! SERVER_PID=$!
popd > /dev/null popd > /dev/null