diff --git a/lib/middleware/csp.js b/lib/middleware/csp.js index 76f6cca8..34d7b281 100644 --- a/lib/middleware/csp.js +++ b/lib/middleware/csp.js @@ -1,7 +1,7 @@ const parseurl = require("parseurl"); const Router = require("router"); const querystring = require("querystring"); - +const fs = require("fs"); const log = require("@ui5/logger").getLogger("server:middleware:csp"); const HEADER_CONTENT_SECURITY_POLICY = "Content-Security-Policy"; @@ -42,6 +42,7 @@ function containsPath(uriPath, req, pathName) { * @property {string} defaultPolicy2 * @property {boolean} defaultPolicy2IsReportOnly * @property {object} definedPolicies + * @property {boolean} generateCSPReports whether to generate the csp resources * @property {boolean} serveCSPReports whether to serve the csp resources * @property {string[]} ignorePaths URI paths which are ignored by the CSP reports, * e.g. ["test-resources/sap/ui/qunit/testrunner.html"] @@ -64,6 +65,7 @@ function createMiddleware(sCspUrlParameterName, oConfig) { defaultPolicy2 = null, defaultPolicy2IsReportOnly = false, definedPolicies = {}, + generateCSPReports = false, serveCSPReports = false, ignorePaths = [] } = oConfig; @@ -99,6 +101,14 @@ function createMiddleware(sCspUrlParameterName, oConfig) { // extract the csp-report and add it to the cspReportEntries list cspReportEntries.push(cspReportObject); } + if (generateCSPReports) { + fs.writeFile("./cspReport.json", JSON.stringify(cspReportEntries), function(err) { + if (err) { + const error = new Error(`Cannot write file to path specified`); + log.error(error); + } + }); + } res.end(); } else { next();