openvibers/openvibe.network Commits

openvibe.link serves its egress settings script (#734)

OP OpenVibers committed 4 days ago · 58ca000fb8 · 2 files, +10 −2

The Link page loads /egress-settings.js, which had no route on the Link host: it 301'd to openvibe.network, 404'd there and was blocked by its same-origin resource policy, so the egress settings form never got its script (found in a production sweep, 11-09).

Changes

ddiff --git a/server/link/routes.js b/server/link/routes.js
iindex d45fc597..48622a42 100644
---- a/server/link/routes.js
++++ b/server/link/routes.js
@@@ -114,8 +114,11 @@ function createLinkRoutes({ releaseId, releaseApi = release } = {}) {
                  'Access-Control-Allow-Origin': '*', 'X-Content-Type-Options': 'nosniff' });
              return res.end(req.method === 'HEAD' ? undefined : source);
          }
--        if (path === '/send.js' && (req.method === 'GET' || req.method === 'HEAD')) {
--            const source = fs.readFileSync(pathLib.join(__dirname, 'send.js'), 'utf8');
++        // The page's two scripts, from this folder: send.js and egress-settings.js. The second had no route, so
++        // openvibe.link/egress-settings.js fell through to the host's 301 onto openvibe.network, where it 404s and its
++        // same-origin resource policy blocks it (found 11-09): the egress form never got its script.
++        if ((path === '/send.js' || path === '/egress-settings.js') && (req.method === 'GET' || req.method === 'HEAD')) {
++            const source = fs.readFileSync(pathLib.join(__dirname, path.slice(1)), 'utf8');
              res.set({ 'Content-Type': 'text/javascript; charset=utf-8', 'Cache-Control': 'public, max-age=600', 'X-Content-Type-Options': 'nosniff' });
              return res.end(req.method === 'HEAD' ? undefined : source);
          }
ddiff --git a/test/link-home.test.js b/test/link-home.test.js
iindex 95d65a8c..69b8d5e0 100644
---- a/test/link-home.test.js
++++ b/test/link-home.test.js
@@@ -188,6 +188,11 @@ const SHAPED = {
          const sendScript = await get('/send.js', 'openvibe.link');
          assert.strictEqual(sendScript.status, 200, 'Link Send script is served on the Link host');
          assert.ok(sendScript.body.includes('locker.seal'), 'the page seals content before upload');
++        // Every script the page names is served on the Link host itself (egress-settings.js 301'd to Network and 404'd).
++        for (const src of [...html.matchAll(/<script[^>]+src="(\/[^"/][^"]*)"/g)].map((m) => m[1]).filter((s) => !s.startsWith('/shared/'))) {
++            const script = await get(src, 'openvibe.link');
++            assert.strictEqual(script.status, 200, `${src} is served on openvibe.link`);
++        }
          const locker = await get('/locker.mjs', 'openvibe.link');
          assert.strictEqual(locker.status, 200, 'the SDK browser bundle is served for Link');
          assert.strictEqual(locker.headers['access-control-allow-origin'], '*', 'the public SDK bundle can be imported by Link\'s loopback window');