Skip to content

Commit 4bca2c5

Browse files
Madman10KMadman10K
committed
security(electron): added content security policy and moved inline js out of html files + small refactoring and reformatting
1 parent 7b85bc6 commit 4bca2c5

File tree

13 files changed

+66
-45
lines changed

13 files changed

+66
-45
lines changed

‎appimage-scripts/build_appimage.sh‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -177,6 +177,9 @@ cp "${ROOT_PATH}/src/helpers.js" "${APP_DIR}/helpers.js"
177177
cp "${ROOT_PATH}/src/frontend/index.html" "${APP_DIR}/src/index.html"
178178
cp "${ROOT_PATH}/src/frontend/index.html" "${APP_DIR}/index.html"
179179

180+
cp "${ROOT_PATH}/src/frontend/init.js" "${APP_DIR}/src/init.js"
181+
cp "${ROOT_PATH}/src/frontend/init.js" "${APP_DIR}/init.js"
182+
180183
cp "${ROOT_PATH}/src/frontend/subwindow.html" "${APP_DIR}/subwindow.html"
181184
cp "${ROOT_PATH}/src/frontend/subwindow.html" "${APP_DIR}/src/subwindow.html"
182185

‎nix/packages/default.nix‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -666,6 +666,7 @@
666666
cp -r src/frontend/index.html $out/
667667
cp -r src/frontend/subwindow.html $out/
668668
669+
cp -r src/frontend/init.js $out/
669670
'';
670671

671672
meta.mainProgram = "ct";

‎non-nix-build/build_in_simple_env.sh‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -50,6 +50,8 @@ cp "$ROOT_DIR"/src/helpers.js "$DIST_DIR"/src/helpers.js
5050
cp "$ROOT_DIR"/src/helpers.js "$DIST_DIR"/helpers.js
5151
cp "$ROOT_DIR"/src/frontend/*.html "$DIST_DIR"/src/
5252
cp "$ROOT_DIR"/src/frontend/*.html "$DIST_DIR"/
53+
cp "$ROOT_DIR"/src/frontend/*.js "$DIST_DIR"/src/
54+
cp "$ROOT_DIR"/src/frontend/*.js "$DIST_DIR"/
5355
rm -f "$DIST_DIR"/config
5456
rm -f "$DIST_DIR"/public
5557
cp -r "$ROOT_DIR"/src/config "$DIST_DIR"/config

‎src/Tupfile‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ include_rules
55
: frontend/subwindow.nim |> !nim_node_subwindow |> subwindow.js | subwindow.js.map
66
: frontend/index.nim |> !nim_node_index_server |> server_index.js | server_index.js.map
77
: frontend/ui_js.nim |> !nim_js |> ui.js
8+
: frontend/init.js |> cp %f %o |> init.js
89
# : frontend/browsersync_serv.nim |> !nim_node |> browsersync_serv.js
910
# : frontend/codetracer_shell.nim |> !codetracer_shell |> bin/codetracer_shell.js
1011

‎src/Tupfile.ini‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎src/frontend/index.html‎

Lines changed: 17 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -4,14 +4,28 @@
44
<!-- bootstrap 4 : credit to bootstrap authors-->
55

66
<!doctype html>
7-
<html>
7+
<html lang="en">
88
<head>
99
<meta charset='utf-8'>
1010
<title>CodeTracer</title>
1111

12+
<meta http-equiv="Content-Security-Policy" content="
13+
default-src 'none';
14+
script-src 'self';
15+
style-src 'self' 'unsafe-inline';
16+
img-src 'self' data: blob:;
17+
font-src 'self' data:;
18+
connect-src 'self';
19+
worker-src 'self' blob:;
20+
media-src 'self';
21+
object-src 'none';
22+
base-uri 'self';
23+
form-action 'self';
24+
">
1225
<!--
1326
don't remove this: placeholder and default,
14-
later we use `loadTheme` in ui_js.nim to load the configured theme -->
27+
later we use `loadTheme` in ui_js.nim to load the configured theme
28+
-->
1529
<link id='theme' rel='stylesheet' href='frontend/styles/default_dark_theme_electron.css'>
1630

1731
<link rel='stylesheet' href='frontend/styles/loader.css'>
@@ -38,15 +52,7 @@
3852
<link rel="stylesheet" href="public/third_party/@exuanbo/file-icons-js/dist/css/file-icons.css" type="text/css" />
3953
<link rel="stylesheet" href="public/third_party/devicon-base.css" type="text/css" />
4054

41-
<script>
42-
self.module = undefined
43-
self.process.browser = true
44-
45-
window.electron = require('electron');
46-
47-
inElectron = true
48-
loadScripts = true
49-
</script>
55+
<script type='text/javascript' src="init.js"></script>
5056

5157
</head>
5258
<body>

‎src/frontend/init.js‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,8 @@
1+
'use strict'
2+
self.module = undefined
3+
self.process.browser = true
4+
5+
window.electron = require('electron');
6+
7+
window.inElectron = true
8+
window.loadScripts = true

‎src/frontend/lib/electron_lib.nim‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -104,8 +104,8 @@ when defined(ctIndex) or defined(ctTest) or defined(ctInCentralExtensionContext)
104104
var nodePath*: NodePath
105105

106106
when defined(ctRenderer):
107-
var inElectron* {.importc.}: bool
108-
var loadScripts* {.importc.}: bool
107+
var inElectron* {.importc: "window.inElectron".}: bool
108+
var loadScripts* {.importc: "window.loadScripts".}: bool
109109
else:
110110
var inElectron*: bool = false
111111
var loadScripts*: bool = false

‎src/frontend/preload.js‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎src/frontend/subwindow.html‎

Lines changed: 17 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,16 +1,28 @@
11
<!DOCTYPE html>
2-
<html>
2+
<html lang="en">
33
<head>
44
<meta charset="UTF-8">
5+
<meta http-equiv="Content-Security-Policy" content="
6+
default-src 'none';
7+
script-src 'self';
8+
style-src 'self' 'unsafe-inline';
9+
img-src 'self' data: blob:;
10+
font-src 'self' data:;
11+
connect-src 'self';
12+
worker-src 'self' blob:;
13+
media-src 'self';
14+
object-src 'none';
15+
base-uri 'self';
16+
form-action 'self';
17+
">
18+
519
<title>Install Subwindow</title>
620
<link rel='stylesheet' href='frontend/styles/subwindow.css'>
721
</head>
822
<body>
923
<div id="ROOT"></div>
10-
<script>
11-
window.electron = require('electron');
12-
window.inElectron = true
13-
</script>
24+
25+
<script type='text/javascript' src="init.js"></script>
1426
<script type="text/javascript" src="subwindow.js"></script>
1527
</body>
1628
</html>

0 commit comments

Comments
 (0)