-
Notifications
You must be signed in to change notification settings - Fork 692
/
csp.go
50 lines (42 loc) · 1.16 KB
/
csp.go
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
package coderd
import (
"encoding/json"
"net/http"
"github.com/coder/coder/coderd/httpapi"
"github.com/coder/coder/codersdk"
"cdr.dev/slog"
)
type cspViolation struct {
Report map[string]interface{} `json:"csp-report"`
}
// logReportCSPViolations will log all reported csp violations.
//
// @Summary Report CSP violations
// @ID report-csp-violations
// @Security CoderSessionToken
// @Accept json
// @Produce text/plain
// @Tags General
// @Param request body cspViolation true "Violation report"
// @Success 200
// @Router /csp/reports [post]
func (api *API) logReportCSPViolations(rw http.ResponseWriter, r *http.Request) {
ctx := r.Context()
var v cspViolation
dec := json.NewDecoder(r.Body)
err := dec.Decode(&v)
if err != nil {
api.Logger.Warn(ctx, "csp violation", slog.Error(err))
httpapi.Write(ctx, rw, http.StatusBadRequest, codersdk.Response{
Message: "Failed to read body, invalid json.",
Detail: err.Error(),
})
return
}
fields := make([]slog.Field, 0, len(v.Report))
for k, v := range v.Report {
fields = append(fields, slog.F(k, v))
}
api.Logger.Debug(ctx, "csp violation", fields...)
httpapi.Write(ctx, rw, http.StatusOK, "ok")
}