Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: add CSP and enhance nonce generation #934

Merged
merged 16 commits into from
Jan 13, 2025
Merged

feat: add CSP and enhance nonce generation #934

merged 16 commits into from
Jan 13, 2025

Conversation

ensc
Copy link
Contributor

@ensc ensc commented Jan 6, 2025 •
edited
Loading

  • adds nonce="{{__TRUNK NONCE__}}" placeholders to most/all generated links
  • replaces {{__TRUNK NONCE__}} with a random nonce when serving a request
  • adds Content-Security-Policy header with this random nonce
  • adds configuration options to:
    • disable nonce generation
    • use a custom CSP
    • change used placeholder

ensc added 10 commits January 6, 2025 11:47
@ensc
common: add nonce_attr()
aa69368 
Will be used later to conditionally add 'nonce="PLACEHOLDER"' attributes
to various html elements.

Signed-off-by: Enrico Scholz <[email protected]>
@ensc
config:build: add 'create_nonce' attribute
fdff55a
@ensc
pipelines:inline: store runtime build config in object
4035ce2 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:inline: create nonce-attribute with placeholder, not with v…
c4aa8c6 
…alue

Do not fill the random when creating the template but use a
placeholder which is expanded by the server.

Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:sass: create nonce-attribute with placeholder, not with value
af7a7e0 
Do not fill the random when creating the template but use a
placeholder which is expanded by the server.

Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:tailwind: create nonce-attribute with placeholder, not with…
16b8c95 
… value

Do not fill the random when creating the template but use a
placeholder which is expanded by the server.

Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:rust: create nonce-attribute with placeholder, not with value
0b9a7e9 
Do not fill the random when creating the template but use a
placeholder which is expanded by the server.

Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:sri: create nonce-attribute
7d6b6e6 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:sri: create nonce-attribute also for external CSS files
a4e122d 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:htlm: create nonce for autoreload script
0784295 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc ensc mentioned this pull request Jan 6, 2025
Closed
ensc added 6 commits January 11, 2025 13:07
@ensc
pipelines:js: create nonce-attribute
1415480 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc
pipelines:icon: create nonce-attribute
c5bd6f5 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc
serve: store config in State
f85c330 
other changes which are dealing with CSP and nonce will need access to
configuration items

Signed-off-by: Enrico Scholz <[email protected]>
@ensc
serve: replace nonce placeholder with random value
9318e05 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc
config:serve: add 'disable-csp' + 'csp' attributes
5dd3331 
Signed-off-by: Enrico Scholz <[email protected]>
@ensc
serve: create Content-Security-Policy header with random nonce
2ce5535 
Signed-off-by: Enrico Scholz <[email protected]>
@ctron ctron added this pull request to the merge queue Jan 13, 2025
Merged via the queue into trunk-rs:main with commit 4fd01b4 Jan 13, 2025
60 checks passed
@tikitko tikitko mentioned this pull request Jan 20, 2025
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@ensc @ctron