From d5f799336e1178d35b7e238ed5d1e83c0eb17c6b Mon Sep 17 00:00:00 2001
From: Marcin Rataj <lidel@lidel.org>
Date: Tue, 17 Dec 2019 02:11:35 +0100
Subject: [PATCH] fix: limit SW registration to content root

Introduces hardening proposed in:
https://github.com/ipfs/go-ipfs/issues/4025#issuecomment-342250616

License: MIT
Signed-off-by: Marcin Rataj <lidel@lidel.org>
---
 core/corehttp/gateway_handler.go | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/core/corehttp/gateway_handler.go b/core/corehttp/gateway_handler.go
index c67b56ad017..e8839087ab7 100644
--- a/core/corehttp/gateway_handler.go
+++ b/core/corehttp/gateway_handler.go
@@ -9,6 +9,7 @@ import (
 	"net/url"
 	"os"
 	gopath "path"
+	"regexp"
 	"runtime/debug"
 	"strings"
 	"time"
@@ -155,6 +156,18 @@ func (i *gatewayHandler) getOrHeadHandler(w http.ResponseWriter, r *http.Request
 		ipnsHostname = true
 	}
 
+	// Service Worker registration request
+	if r.Header.Get("Service-Worker") == "script" {
+		// Disallow Service Worker registration on namespace roots
+		// https://github.com/ipfs/go-ipfs/issues/4025
+		matched, _ := regexp.MatchString(`^/ip[fn]s/[^/]+$`, r.URL.Path)
+		if matched {
+			err := fmt.Errorf("registration is not allowed for this scope")
+			webError(w, "navigator.serviceWorker", err, http.StatusBadRequest)
+			return
+		}
+	}
+
 	parsedPath := ipath.New(urlPath)
 	if err := parsedPath.IsValid(); err != nil {
 		webError(w, "invalid ipfs path", err, http.StatusBadRequest)