Skip to content

Commit eaacb4d

Browse files
php-coderphp-coder
committed
chore(security): use our own server for CSP reports instead of report-uri.com
Addressed to #226
1 parent 7e504dd commit eaacb4d

File tree

4 files changed

+29
-17
lines changed

4 files changed

+29
-17
lines changed

‎src/main/java/ru/mystamps/web/support/spring/security/ContentSecurityPolicyHeaderWriter.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import org.springframework.security.web.header.HeaderWriter;
2222
import ru.mystamps.web.feature.collection.CollectionUrl;
2323
import ru.mystamps.web.feature.series.SeriesUrl;
24+
import ru.mystamps.web.feature.site.SiteUrl;
2425

2526
import javax.servlet.http.HttpServletRequest;
2627
import javax.servlet.http.HttpServletResponse;
@@ -62,8 +63,7 @@ class ContentSecurityPolicyHeaderWriter implements HeaderWriter {
6263
// - 'https://maxcdn.bootstrapcdn.com' is required by glyphicons-halflings-regular.woff2
6364
private static final String FONT_SRC_CDN = "font-src https://maxcdn.bootstrapcdn.com";
6465

65-
// CheckStyle: ignore LineLength for next 1 line
66-
private static final String REPORT_URI = "report-uri https://mystamps.report-uri.com/r/d/csp/reportOnly";
66+
private static final String REPORT_URI = "report-uri ";
6767

6868
// - 'https://cdn.jsdelivr.net' is required by languages.min.css (FIXME: GH #246)
6969
private static final String STYLE_SRC = "style-src https://cdn.jsdelivr.net";
@@ -165,6 +165,7 @@ class ContentSecurityPolicyHeaderWriter implements HeaderWriter {
165165

166166
private final boolean useSingleHost;
167167
private final boolean hasH2Console;
168+
private final String host;
168169

169170
@Override
170171
public void writeHeaders(HttpServletRequest request, HttpServletResponse response) {
@@ -183,7 +184,7 @@ protected String constructDirectives(String uri) {
183184
sb.append(DEFAULT_SRC).append(SEPARATOR)
184185
.append(IMG_SRC).append(useSingleHost ? IMG_SRC_SELF : IMG_SRC_CDN).append(SEPARATOR)
185186
.append(useSingleHost ? FONT_SRC_SELF : FONT_SRC_CDN).append(SEPARATOR)
186-
.append(REPORT_URI).append(SEPARATOR)
187+
.append(REPORT_URI).append(host).append(SiteUrl.CSP_REPORTS_HANDLER).append(SEPARATOR)
187188
.append(STYLE_SRC)
188189
.append(useSingleHost ? STYLES_SELF : STYLES_CDN);
189190

‎src/main/java/ru/mystamps/web/support/spring/security/SecurityConfig.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,13 @@ public void configure(WebSecurity web) throws Exception {
8282
protected void configure(HttpSecurity http) throws Exception {
8383
boolean useSingleHost = !environment.acceptsProfiles("prod");
8484
boolean hasH2Console = environment.acceptsProfiles("test");
85+
86+
// @todo #226 Introduce app.use-public-hostname property
87+
boolean usePublicHostname = environment.acceptsProfiles("prod");
88+
String hostname = usePublicHostname ? SiteUrl.PUBLIC_URL : SiteUrl.SITE;
8589

8690
ContentSecurityPolicyHeaderWriter cspWriter =
87-
new ContentSecurityPolicyHeaderWriter(useSingleHost, hasH2Console);
91+
new ContentSecurityPolicyHeaderWriter(useSingleHost, hasH2Console, hostname);
8892

8993
http
9094
.authorizeRequests()

‎src/test/java/ru/mystamps/web/support/spring/security/ContentSecurityPolicyHeaderWriterTest.java‎

Lines changed: 15 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,8 @@
2020
import org.junit.Test;
2121
import org.springframework.mock.web.MockHttpServletRequest;
2222
import org.springframework.mock.web.MockHttpServletResponse;
23+
import ru.mystamps.web.feature.site.SiteUrl;
24+
import ru.mystamps.web.tests.Random;
2325

2426
import javax.servlet.http.HttpServletRequest;
2527
import javax.servlet.http.HttpServletResponse;
@@ -46,7 +48,7 @@ public class ContentSecurityPolicyHeaderWriterTest {
4648
@Test
4749
public void writeContentSecurityPolicyHeader() {
4850
ContentSecurityPolicyHeaderWriter writer =
49-
new ContentSecurityPolicyHeaderWriter(bool(), bool());
51+
new ContentSecurityPolicyHeaderWriter(bool(), bool(), Random.host());
5052

5153
HttpServletRequest request = new MockHttpServletRequest();
5254
HttpServletResponse response = new MockHttpServletResponse();
@@ -64,7 +66,7 @@ public void writeContentSecurityPolicyHeader() {
6466
@Test
6567
public void onIndexPageWithLocalResources() {
6668
ContentSecurityPolicyHeaderWriter writer =
67-
new ContentSecurityPolicyHeaderWriter(true, bool());
69+
new ContentSecurityPolicyHeaderWriter(true, bool(), SiteUrl.SITE);
6870
String[] directives = writer.constructDirectives("/").split(";");
6971

7072
assertThat(directives, hasItemInArray("default-src 'none'"));
@@ -78,7 +80,7 @@ public void onIndexPageWithLocalResources() {
7880

7981
assertThat(
8082
directives,
81-
hasItemInArray("report-uri https://mystamps.report-uri.com/r/d/csp/reportOnly")
83+
hasItemInArray("report-uri http://127.0.0.1:8080/site/csp/reports")
8284
);
8385

8486
assertThat(directives, hasItemInArray("style-src https://cdn.jsdelivr.net 'self'"));
@@ -90,7 +92,7 @@ public void onIndexPageWithLocalResources() {
9092
@Test
9193
public void onIndexPageWithResourcesFromCdn() {
9294
ContentSecurityPolicyHeaderWriter writer
93-
= new ContentSecurityPolicyHeaderWriter(false, bool());
95+
= new ContentSecurityPolicyHeaderWriter(false, bool(), SiteUrl.PUBLIC_URL);
9496
String[] directives = writer.constructDirectives("/").split(";");
9597

9698
assertThat(directives, hasItemInArray("default-src 'none'"));
@@ -104,7 +106,7 @@ public void onIndexPageWithResourcesFromCdn() {
104106

105107
assertThat(
106108
directives,
107-
hasItemInArray("report-uri https://mystamps.report-uri.com/r/d/csp/reportOnly")
109+
hasItemInArray("report-uri https://my-stamps.ru/site/csp/reports")
108110
);
109111

110112
assertThat(
@@ -134,7 +136,7 @@ public void onIndexPageWithResourcesFromCdn() {
134136
@Test
135137
public void onCollectionInfoPageWithLocalResources() {
136138
ContentSecurityPolicyHeaderWriter writer =
137-
new ContentSecurityPolicyHeaderWriter(true, bool());
139+
new ContentSecurityPolicyHeaderWriter(true, bool(), Random.host());
138140
String[] directives = writer.constructDirectives("/collection/user").split(";");
139141

140142
// test only the directives that differ from the index page
@@ -167,7 +169,7 @@ public void onCollectionInfoPageWithLocalResources() {
167169
@Test
168170
public void onCollectionInfoPageWithResourcesFromCdn() {
169171
ContentSecurityPolicyHeaderWriter writer =
170-
new ContentSecurityPolicyHeaderWriter(false, bool());
172+
new ContentSecurityPolicyHeaderWriter(false, bool(), Random.host());
171173
String[] directives = writer.constructDirectives("/collection/user").split(";");
172174

173175
// test only the directives that differ from the index page
@@ -203,7 +205,7 @@ public void onCollectionInfoPageWithResourcesFromCdn() {
203205
@Test
204206
public void onSeriesAddImagePageWithLocalResources() {
205207
ContentSecurityPolicyHeaderWriter writer =
206-
new ContentSecurityPolicyHeaderWriter(true, bool());
208+
new ContentSecurityPolicyHeaderWriter(true, bool(), Random.host());
207209

208210
for (String page : new String[]{"/series/11", "/series/12/ask", "/series/13/image"}) {
209211
String[] directives = writer.constructDirectives(page).split(";");
@@ -229,7 +231,7 @@ public void onSeriesAddImagePageWithLocalResources() {
229231
@Test
230232
public void onSeriesAddImagePageWithResourcesFromCdn() {
231233
ContentSecurityPolicyHeaderWriter writer =
232-
new ContentSecurityPolicyHeaderWriter(false, bool());
234+
new ContentSecurityPolicyHeaderWriter(false, bool(), Random.host());
233235

234236
for (String page : new String[]{"/series/11", "/series/12/ask", "/series/13/image"}) {
235237
String[] directives = writer.constructDirectives(page).split(";");
@@ -268,7 +270,7 @@ public void onSeriesAddImagePageWithResourcesFromCdn() {
268270
@Test
269271
public void onSeriesAddPageWithLocalResources() {
270272
ContentSecurityPolicyHeaderWriter writer =
271-
new ContentSecurityPolicyHeaderWriter(true, bool());
273+
new ContentSecurityPolicyHeaderWriter(true, bool(), Random.host());
272274
String[] directives = writer.constructDirectives("/series/add").split(";");
273275

274276
// test only the directives that differ from the index page
@@ -302,7 +304,7 @@ public void onSeriesAddPageWithLocalResources() {
302304
@Test
303305
public void onSeriesAddPageWithResourcesFromCdn() {
304306
ContentSecurityPolicyHeaderWriter writer =
305-
new ContentSecurityPolicyHeaderWriter(false, bool());
307+
new ContentSecurityPolicyHeaderWriter(false, bool(), Random.host());
306308
String[] directives = writer.constructDirectives("/series/add").split(";");
307309

308310
// test only the directives that differ from the index page
@@ -339,7 +341,7 @@ public void onSeriesAddPageWithResourcesFromCdn() {
339341
@Test
340342
public void onH2ConsoleWithLocalResources() {
341343
ContentSecurityPolicyHeaderWriter writer =
342-
new ContentSecurityPolicyHeaderWriter(true, true);
344+
new ContentSecurityPolicyHeaderWriter(true, true, Random.host());
343345
String[] directives = writer.constructDirectives("/console/").split(";");
344346

345347
// test only the directives that are differ from the index page
@@ -374,7 +376,7 @@ public void onH2ConsoleWithLocalResources() {
374376
@Test
375377
public void onH2ConsoleWithResourcesFromCdn() {
376378
ContentSecurityPolicyHeaderWriter writer =
377-
new ContentSecurityPolicyHeaderWriter(false, false);
379+
new ContentSecurityPolicyHeaderWriter(false, false, Random.host());
378380
String[] directives = writer.constructDirectives("/console/").split(";");
379381

380382
// "style-src" directive should be the same as for the index page

‎src/test/java/ru/mystamps/web/tests/Random.java‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
import ru.mystamps.web.feature.series.SeriesValidation;
3333
import ru.mystamps.web.feature.series.importing.ImportRequestFullInfo;
3434
import ru.mystamps.web.feature.series.importing.SeriesImportDb.SeriesImportRequestStatus;
35+
import ru.mystamps.web.feature.site.SiteUrl;
3536
import ru.mystamps.web.service.TestObjects;
3637

3738
import java.math.BigDecimal;
@@ -299,6 +300,10 @@ public static String jsoupLocator() {
299300
return sample("#id", "a[href]", "img[src$=.png]", "div#logo");
300301
}
301302

303+
public static String host() {
304+
return sample(SiteUrl.SITE, SiteUrl.PUBLIC_URL);
305+
}
306+
302307
private static Set<String> catalogNumbers() {
303308
final int minSize = 1;
304309
final int maxSize = 7;

0 commit comments

Comments
 (0)