github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 17:59:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

[HTTP] Fix CSP config merge behaviour (#177728)

Browse source
This commit is contained in:
Jean-Louis Leysens 2024-02-26 11:13:38 +01:00 • committed by GitHub
parent d3ca0d228a
commit e7d6d0df14
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 28 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

23
packages/core/http/core-http-server-internal/src/csp/csp_directives.test.ts
View file

@ -121,5 +121,28 @@ describe('CspDirectives', () => {
`"script-src 'report-sample' 'self' 'unsafe-hashes'; worker-src 'report-sample' 'self' blob:; style-src 'report-sample' 'self' 'unsafe-inline'"`
);
});
it('merges additional CSP configs as expected', () => {
const config = cspConfig.schema.validate({
connect_src: ['*.foo.bar'], // should de-dupe these
});
const additionalConfig1 = {
connect_src: ['*.foo.bar'],
img_src: ['*.foo.bar'],
};
const additionalConfig2 = {
connect_src: [`cdn.host.test`],
font_src: [`cdn.host.test`],
frame_src: [`cdn.host.test`],
img_src: [`cdn.host.test`],
worker_src: [`cdn.host.test`],
script_src: [`cdn.host.test`],
style_src: [`cdn.host.test`],
};
const directives = CspDirectives.fromConfig(config, additionalConfig1, additionalConfig2);
expect(directives.getCspHeader()).toEqual(
`script-src 'report-sample' 'self' cdn.host.test; worker-src 'report-sample' 'self' blob: cdn.host.test; style-src 'report-sample' 'self' 'unsafe-inline' cdn.host.test; connect-src 'self' *.foo.bar cdn.host.test; font-src 'self' cdn.host.test; frame-src 'self' cdn.host.test; img-src 'self' *.foo.bar cdn.host.test`
);
});
});
});

7
packages/core/http/core-http-server-internal/src/csp/csp_directives.ts
View file

@ -6,7 +6,7 @@
* Side Public License, v 1.
*/
import { merge } from 'lodash';
import deepmerge from 'deepmerge';
import { CspConfigType } from './config';
export type CspDirectiveName =
@ -70,7 +70,10 @@ export class CspDirectives {
firstConfig: CspConfigType,
...otherConfigs: Array<Partial<CspConfigType>>
): CspDirectives {
const config = otherConfigs.length ? merge(firstConfig, ...otherConfigs) : firstConfig;
const config = otherConfigs.reduce<CspConfigType>(
(acc, conf) => deepmerge(acc, conf),
firstConfig
);
const cspDirectives = new CspDirectives();
// combining `default` directive configurations