Skip to content
This repository has been archived by the owner on May 3, 2024. It is now read-only.

fix(addFrameOptions): strict csp domain now matches #704

Merged
merged 1 commit into from
Mar 24, 2022
Merged

fix(addFrameOptions): strict csp domain now matches #704

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 3 additions & 3 deletions __tests__/server/middleware/addFrameOptionsHeader.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -18,7 +18,7 @@ import addFrameOptionsHeader from '../../../src/server/middleware/addFrameOption

jest.mock('../../../src/server/middleware/csp', () => ({
getCSP: () => ({
'frame-ancestors': ['*.example.com'],
'frame-ancestors': ['valid.example.com'],
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

How will these tests protect against regression?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this was the previously failing scenario.

}),
}));

Expand All @@ -36,14 +36,14 @@ describe('addFrameOptionsHeader', () => {

it('should add X-Frame-Options ALLOW-FROM header on approved ancestor', () => {
req = {
get: jest.fn(() => 'https://external.example.com/embedded'),
get: jest.fn(() => 'https://valid.example.com/embedded'),
};
addFrameOptionsHeader(req, res, next);

expect(req.get).toHaveBeenCalledWith('Referer');
expect(res.set).toBeCalledWith(
'X-Frame-Options',
'ALLOW-FROM https://external.example.com/embedded'
'ALLOW-FROM https://valid.example.com/embedded'
);
expect(next).toBeCalled();
});
Expand Down
2 changes: 1 addition & 1 deletion package-lock.json
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

4 changes: 2 additions & 2 deletions src/server/middleware/addFrameOptionsHeader.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -21,8 +21,8 @@ export default function addFrameOptionsHeader(req, res, next) {
const referer = req.get('Referer');

const frameAncestorDomains = getCSP()['frame-ancestors'];

const matchedDomain = frameAncestorDomains && frameAncestorDomains.find((domain) => matcher.isMatch(referer, `${domain}/*`)
const trimmedReferrer = referer && referer.replace('https://', '');
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why was https:// causing issues?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

because if the referrer is https://some.domain.com it will always fail to match against some.domain.com . i think it is safer to strip https:// instead of putting a wildcard in front of the csp domain.

const matchedDomain = frameAncestorDomains && frameAncestorDomains.find((domain) => matcher.isMatch(trimmedReferrer, `${domain}/*`)
);

if (matchedDomain) {
Expand Down