diff --git a/package.json b/package.json index 4550ca1..ee16149 100644 --- a/package.json +++ b/package.json @@ -17,5 +17,5 @@ "npm-run-all": "^4.1.5", "shelljs": "^0.8.5" }, - "packageManager": "pnpm@9.11.0" + "packageManager": "pnpm@9.15.4" } diff --git a/packages/backend/Cargo.lock b/packages/backend/Cargo.lock index 4d933e9..6330ca3 100644 --- a/packages/backend/Cargo.lock +++ b/packages/backend/Cargo.lock @@ -255,7 +255,7 @@ dependencies = [ [[package]] name = "cryptgeon" -version = "2.8.4" +version = "2.9.0" dependencies = [ "axum", "bs62", diff --git a/packages/backend/Cargo.toml b/packages/backend/Cargo.toml index 0cd6bb4..ca6cae5 100644 --- a/packages/backend/Cargo.toml +++ b/packages/backend/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "cryptgeon" -version = "2.8.4" +version = "2.9.0" authors = ["cupcakearmy "] edition = "2021" rust-version = "1.80" diff --git a/packages/backend/src/csp.rs b/packages/backend/src/csp.rs new file mode 100644 index 0000000..e21ad69 --- /dev/null +++ b/packages/backend/src/csp.rs @@ -0,0 +1,16 @@ +use axum::{body::Body, extract::Request, http::HeaderValue, middleware::Next, response::Response}; + +const CUSTOM_HEADER_NAME: &str = "Content-Security-Policy"; +const CUSTOM_HEADER_VALUE: &str = "default-src 'self'; script-src 'report-sample' 'self'; style-src 'report-sample' 'self'; object-src 'none'; base-uri 'self'; connect-src 'self' data:; font-src 'self'; frame-src 'self'; img-src 'self'; manifest-src 'self'; media-src 'self'; worker-src 'none';"; + +lazy_static! { + static ref HEADER_VALUE: HeaderValue = HeaderValue::from_static(CUSTOM_HEADER_VALUE); +} + +pub async fn add_csp_header(request: Request, next: Next) -> Response { + let mut response = next.run(request).await; + response + .headers_mut() + .append(CUSTOM_HEADER_NAME, HEADER_VALUE.clone()); + response +} diff --git a/packages/backend/src/main.rs b/packages/backend/src/main.rs index 9591b60..a7044ad 100644 --- a/packages/backend/src/main.rs +++ b/packages/backend/src/main.rs @@ -1,7 +1,11 @@ use std::{collections::HashMap, sync::Arc}; use axum::{ + body::Body, extract::{DefaultBodyLimit, Request}, + http::HeaderValue, + middleware::{self, Next}, + response::Response, routing::{delete, get, post}, Router, ServiceExt, }; @@ -19,6 +23,7 @@ use tower_http::{ extern crate lazy_static; mod config; +mod csp; mod health; mod lock; mod note; @@ -55,6 +60,8 @@ async fn main() { let app = Router::new() .nest("/api", api_routes) .fallback_service(serve_dir) + // Disabled for now, as svelte inlines scripts + // .layer(middleware::from_fn(csp::add_csp_header)) .layer(DefaultBodyLimit::max(*config::LIMIT)) .layer( CompressionLayer::new() diff --git a/packages/cli/package.json b/packages/cli/package.json index 906a6e2..160782f 100644 --- a/packages/cli/package.json +++ b/packages/cli/package.json @@ -1,6 +1,6 @@ { "name": "cryptgeon", - "version": "2.8.4", + "version": "2.9.0", "homepage": "https://github.com/cupcakearmy/cryptgeon", "repository": { "type": "git", diff --git a/packages/frontend/package.json b/packages/frontend/package.json index 91a147e..d162a45 100644 --- a/packages/frontend/package.json +++ b/packages/frontend/package.json @@ -13,23 +13,23 @@ }, "type": "module", "devDependencies": { - "@lokalise/node-api": "^12.1.0", - "@sveltejs/adapter-static": "^3.0.1", - "@sveltejs/kit": "^2.5.2", - "@sveltejs/vite-plugin-svelte": "^3.0.2", - "@zerodevx/svelte-toast": "^0.9.5", - "adm-zip": "^0.5.10", - "dotenv": "^16.4.5", - "svelte": "^4.2.12", - "svelte-check": "^3.6.6", + "@lokalise/node-api": "^13.0.0", + "@sveltejs/adapter-static": "^3.0.8", + "@sveltejs/kit": "^2.16.0", + "@sveltejs/vite-plugin-svelte": "^5.0.3", + "@zerodevx/svelte-toast": "^0.9.6", + "adm-zip": "^0.5.16", + "dotenv": "^16.4.7", + "svelte": "^5.19.0", + "svelte-check": "^4.1.4", "svelte-intl-precompile": "^0.12.3", - "tslib": "^2.6.2", - "typescript": "^5.3.3", - "vite": "^5.1.7" + "tslib": "^2.8.1", + "typescript": "^5.7.3", + "vite": "^6.0.7" }, "dependencies": { + "@fontsource/fira-mono": "^5.1.1", "cryptgeon": "workspace:*", - "@fontsource/fira-mono": "^5.0.8", "occulto": "^2.0.6", "pretty-bytes": "^6.1.1", "qrious": "^4.0.2" diff --git a/packages/frontend/src/lib/icons/IconContrast.svelte b/packages/frontend/src/lib/icons/IconContrast.svelte index a96c3dc..02d20e6 100644 --- a/packages/frontend/src/lib/icons/IconContrast.svelte +++ b/packages/frontend/src/lib/icons/IconContrast.svelte @@ -1,3 +1,5 @@ + + Contrast + Copy + Dice + Eye + Eye Off - export let title: string + import type { Snippet } from 'svelte' + + interface Props { + title: string + children?: Snippet + } + + let { title, children }: Props = $props()

▶ {title} - + {@render children?.()}