openvibers/openvibe.studio Commits

CSP: let the release watch reach openvibe.events (#6)

OP OpenVibers committed 4 days ago · cb7dfb7666 · 2 files, +3 −1

Since Studio #4 serves /release.json, Shared's release watch also listens on openvibe.events for new releases,
which the CSP refused on every page (11-09 browser sweep). connect-src adds https://openvibe.events, as Computer and
Locker already have; the test checks it.

Changes

ddiff --git a/server/app.js b/server/app.js
iindex df4a479..bd8364a 100644
---- a/server/app.js
++++ b/server/app.js
@@@ -44,7 +44,7 @@ function createApp(opts = {}) {
          styleSrc: ["'self'", "'unsafe-inline'", 'https://openvibe.network', 'https://fonts.googleapis.com'],
          fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
          imgSrc: ["'self'", 'data:', 'https://openvibe.network'],
--        connectSrc: ["'self'", 'https://openvibe.network', 'https://openvibe.download', 'https://openvibe.pics', 'https://cloudflareinsights.com'],
++        connectSrc: ["'self'", 'https://openvibe.network', 'https://openvibe.download', 'https://openvibe.pics', 'https://cloudflareinsights.com', 'https://openvibe.events'],
          frameSrc: ["'self'"],
          frameAncestors: ["'none'"],
          objectSrc: ["'none'"],
ddiff --git a/test/studio.test.js b/test/studio.test.js
iindex c481595..b4659e9 100644
---- a/test/studio.test.js
++++ b/test/studio.test.js
@@@ -204,5 +204,7 @@ test('the app catalogue, the attribution page and the small endpoints answer', a
      assert.equal(manifest.openapi, 'https://openvibe.studio/openapi.json');
      assert.equal((await fetch(s.base + '/robots.txt')).status, 200);
      { const r = await fetch(s.base + '/release.json'); assert.equal(r.status, 200, 'the navbar release watch polls /release.json'); assert.equal((await r.json()).service, 'studio'); }
++    // The release watch then listens on openvibe.events for new releases: the page's CSP must let it (11-09 sweep).
++    assert.match((await fetch(s.base + '/')).headers.get('content-security-policy') || '', /connect-src[^;]*https:\/\/openvibe\.events/);
      assert.equal((await fetch(s.base + '/nope')).status, 404);
  });