[security] Slightly improve CSP header

packages/toolpad-studio/src/server/index.ts

@@ -236,6 +236,23 @@ async function createToolpadHandler({
  res.setHeader('X-Content-Type-Options', 'nosniff');
  res.setHeader('X-XSS-Protection', '1; mode=block');
  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+ res.setHeader(
+ 'Content-Security-Policy',
+ [
+ `default-src * data: mediastream: blob: filesystem: about: ws: wss: 'unsafe-eval' 'wasm-unsafe-eval' 'unsafe-inline';`,
+ `script-src * data: blob: 'unsafe-inline' 'unsafe-eval';`,
+ `script-src-elem * data: blob: 'unsafe-inline';`,
+ `connect-src * data: blob: 'unsafe-inline';`,
+ `img-src * data: blob: 'unsafe-inline';`,
+ `media-src * data: blob: 'unsafe-inline';`,
+ `frame-src * data: blob: ;`,
+ `style-src * data: blob: 'unsafe-inline';`,
+ `font-src * data: blob: 'unsafe-inline';`,
+ `frame-ancestors *;`,
+ ].join(' '),
+ );
+
  expressNext();
  });
 
@@ -279,6 +296,8 @@ async function startToolpadServer({ port, ...config }: ToolpadServerConfig) {
  const circleBuildNum = process.env.CIRCLE_BUILD_NUM || null;
 
  const app = express();
+ app.disable('x-powered-by');
+
  const httpServer = createServer(app);
 
  app.use(compression());

test/integration/deploy/index.spec.ts

@@ -20,12 +20,13 @@ test.use({
 });
 
 test('can render in an iframe', async ({ page, baseURL }) => {
+ await page.goto('https://example.com');
  await page.evaluate(
  ([src]) => {
  const iframe = document.createElement('iframe');
  iframe.src = src;
  iframe.id = 'my-frame';
- document.body.append(iframe);
+ document.body.replaceChildren(iframe);
  },
  [`${baseURL}/prod/pages/o57cdlq`],
  );

test/playwright.config.ts

@@ -1,4 +1,4 @@
-import { PlaywrightTestConfig, devices } from '@playwright/test';
+import { devices, defineConfig } from '@playwright/test';
 
 process.env.BROWSER = 'none';
 
@@ -11,7 +11,7 @@ function getShard() {
  return undefined;
 }
 
-const config: PlaywrightTestConfig<{ toolpadDev: boolean }> = {
+export default defineConfig({
  shard: getShard(),
  forbidOnly: !!process.env.CI,
  retries: process.env.TOOLPAD_TEST_RETRIES ? Number(process.env.TOOLPAD_TEST_RETRIES) : 0,
@@ -45,6 +45,4 @@ const config: PlaywrightTestConfig<{ toolpadDev: boolean }> = {
  use: { ...devices['Desktop Chrome'] },
  },
  ],
-};
-
-export default config;
+});