Fix http server XSS #1714
+48
−10
Set security headers on /favicon.ico responses
- Loading branch information
| @@ -79,10 +79,6 @@ function Server (torrent, opts = {}) { | ||
|
|
||
| const pathname = new URL(req.url, 'http://example.com').pathname | ||
|
|
||
| if (pathname === '/favicon.ico') { | ||
| return serve404Page() | ||
| } | ||
|
|
||
| // Allow cross-origin requests (CORS) | ||
| if (isOriginAllowed(req)) { | ||
| res.setHeader('Access-Control-Allow-Origin', req.headers.origin) | ||
| @@ -94,6 +90,10 @@ function Server (torrent, opts = {}) { | ||
| // Defense-in-depth: Set a strict Content Security Policy to mitigate XSS | ||
| res.setHeader('Content-Security-Policy', "base-uri 'none'; default-src 'none'; frame-ancestors 'none'; object-src 'none';") | ||
|
This conversation was marked as resolved
by feross
|
||
|
|
||
| if (pathname === '/favicon.ico') { | ||
| return serve404Page() | ||
| } | ||
|
|
||
| // Allow CORS requests to specify arbitrary headers, e.g. 'Range', | ||
| // by responding to the OPTIONS preflight request with the specified | ||
| // origin and requested headers. | ||
ProTip!
Use n and p to navigate between commits in a pull request.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
this is super minor but you could also set https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/form-action to none if you wanted to lock it down more