da903db32a
All checks were successful
Build and deploy / Validate source (push) Successful in 5s
Build and deploy / Integration suite on a real stack (push) Successful in 1m10s
Build and deploy / Secret scan and release gate (push) Successful in 5s
Build and deploy / Publish images and notify Portainer (push) Successful in 1m43s
The Site pulled pdf.js 3.11.174 from cdnjs with no integrity attribute, and the policy trusted the whole of cdnjs.cloudflare.com for both script-src and worker-src. Anything that host served would have executed, and a customer measuring a PDF sheet depended on it being reachable. Vendor both files instead of pinning a hash: it removes the dependency rather than constraining it, and lets the policy name only 'self'. Provenance and SHA-256 digests are recorded in local/static/vendor/README.md, verified on download against the SRI digests cdnjs publishes for that release. cdnjs is now absent from script-src, worker-src and connect-src in both gateway templates. Workers are 'self' plus blob:, which the Site needs for the worker it constructs itself. Verified in a browser against the running stack: pdf.js loads from /vendor/, the blob worker starts, and a real seven-page PDF parses with no CSP violation. Both browser suites and the full integration suite pass. The version is deliberately unchanged. 3.11.174 is old, but its known eval path is already closed by isEvalSupported:false, and upgrading is an API change that needs its own testing rather than riding along with this. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
37 lines
1.6 KiB
Plaintext
37 lines
1.6 KiB
Plaintext
limit_req_zone $binary_remote_addr zone=api_limit:10m rate=20r/s;
|
|
server {
|
|
listen 80;
|
|
server_name localhost;
|
|
if ($host !~ ^(localhost|127\.0\.0\.1)$) { return 400; }
|
|
root /usr/share/nginx/html;
|
|
index ${WEB_INDEX};
|
|
add_header X-Content-Type-Options nosniff always;
|
|
add_header Referrer-Policy no-referrer always;
|
|
add_header X-Frame-Options DENY always;
|
|
add_header Permissions-Policy "camera=(), microphone=(), geolocation=()" always;
|
|
add_header Content-Security-Policy "default-src 'self'; script-src 'self' @SCRIPT_HASHES@; script-src-attr 'none'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob: https://cdn.vnda.com.br; connect-src 'self' ${S3_PUBLIC_ENDPOINT} https://cdn.vnda.com.br; worker-src 'self' blob:; object-src 'none'; base-uri 'none'; frame-ancestors 'none'; form-action 'self'" always;
|
|
location = /health { access_log off; return 200 'ok'; }
|
|
location /api/ {
|
|
limit_req zone=api_limit burst=100 nodelay;
|
|
limit_req_status 429;
|
|
proxy_pass http://api:8000;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
client_max_body_size 2m;
|
|
}
|
|
location / { try_files $uri $uri/ =404; }
|
|
}
|
|
server {
|
|
listen 81;
|
|
server_name localhost;
|
|
if ($host !~ ^(localhost|127\.0\.0\.1)$) { return 400; }
|
|
client_max_body_size 2m;
|
|
location / {
|
|
limit_req zone=api_limit burst=100 nodelay;
|
|
limit_req_status 429;
|
|
proxy_pass http://api:8000;
|
|
proxy_set_header Host $http_host;
|
|
proxy_set_header X-Forwarded-For $remote_addr;
|
|
}
|
|
}
|