From 46fef7501713a7c8621bd32c08ad88a1fa4c7c8e Mon Sep 17 00:00:00 2001
From: Randall Morey <randall@randallmorey.com>
Date: Fri, 8 Jan 2021 14:00:14 -0500
Subject: [PATCH] =?UTF-8?q?feat:=20=F0=9F=8E=B8=20setup=20initial=20CSP=20?=
 =?UTF-8?q?for=20desktop?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .../src/content-security-policy.js            | 35 +++++++++++++++++++
 ui/desktop/electron-app/src/index.js          | 12 +++++++
 2 files changed, 47 insertions(+)
 create mode 100644 ui/desktop/electron-app/src/content-security-policy.js

diff --git a/ui/desktop/electron-app/src/content-security-policy.js b/ui/desktop/electron-app/src/content-security-policy.js
new file mode 100644
index 000000000..dffc1c524
--- /dev/null
+++ b/ui/desktop/electron-app/src/content-security-policy.js
@@ -0,0 +1,35 @@
+const isDev = require('electron-is-dev');
+
+const csp = {
+  'default-src': ["'none'"],
+  'script-src': ["'self'"],
+  'frame-src': ["'self'"],
+  'font-src': ["'self'"],
+  'connect-src': ["'self'"],
+  'img-src': ["'self'", 'data:'],
+  'style-src': ["'self'"],
+  'media-src': ["'self'"],
+  'manifest-src': ["'self'"],
+};
+
+// Dev policy is necessary for Ember live reload.
+// Unsafe policy is necessary in development and test environments, but should
+// not be used in production.
+const enableDevCSP = () => {
+  csp['style-src'].push("'unsafe-inline'");
+  csp['script-src'].push("'unsafe-eval'");
+  csp['script-src'].push("'unsafe-inline'");
+  csp['script-src'].push("http://localhost:7020");
+  csp['connect-src'].push("ws://localhost:7020");
+};
+
+const generateCSPHeader = () => Object
+  .keys(csp)
+  .map(key => `${key} ${csp[key].join(' ')};`)
+  .join(' ');
+
+if (isDev) enableDevCSP();
+
+module.exports = {
+  generateCSPHeader: generateCSPHeader
+};
diff --git a/ui/desktop/electron-app/src/index.js b/ui/desktop/electron-app/src/index.js
index a2088505b..9f2f19759 100644
--- a/ui/desktop/electron-app/src/index.js
+++ b/ui/desktop/electron-app/src/index.js
@@ -7,6 +7,8 @@ const {
 const { session, app, protocol, BrowserWindow, ipcMain } = require('electron');
 require('./handlers.js');
 
+const { generateCSPHeader } = require('./content-security-policy.js');
+
 const isDev = require('electron-is-dev');
 
 // Register the custom file protocol
@@ -58,6 +60,16 @@ app.on('ready', async () => {
     return callback(true);
   });
 
+  // Setup content security policy
+  ses.webRequest.onHeadersReceived((details, callback) => {
+    callback({
+      responseHeaders: {
+        ...details.responseHeaders,
+        'Content-Security-Policy': [generateCSPHeader()]
+      }
+    });
+  });
+
   if (isDev) {
     try {
       require('devtron').install();