opensource/teleport
3
0
Fork 0
mirror of https://github.com/gravitational/teleport.git synced 2026-11-03 16:38:35 +08:00
Code Issues Packages Projects Releases Wiki Activity

Don't include Stripe in CSP for enterprise usage-based products (#35456)

Browse Source 
* Don't include Stripe in CSP for enterprise usage-based products

* Fix existing tests, add a new one
This commit is contained in:
Bartosz Leper
2023-12-07 18:11:19 +00:00
committed by GitHub
parent cd92b2d8de
commit 03ab12e8b7
2 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
lib/httplib/httpheaders.go
+1 -1
View File
@@ -189,7 +189,7 @@ var indexCSPStringCache *cspCache = newCSPCache()
func getIndexContentSecurityPolicyString(cfg proto.Features, urlPath string) string {
// Check for result with this cfg and urlPath in cache
withStripe := cfg.GetCloud() && cfg.GetIsUsageBased()
withStripe := cfg.GetProductType() == proto.ProductType_PRODUCT_TYPE_TEAM
key := fmt.Sprintf("%v-%v", withStripe, urlPath)
if cspString, ok := indexCSPStringCache.get(key); ok {
return cspString
lib/httplib/httplib_test.go
+20 -4
View File
@@ -294,8 +294,8 @@ func TestSetIndexContentSecurityPolicy(t *testing.T) {
},
},
{
name: "for cloud based usage (with stripe, no wasm)",
features: proto.Features{Cloud: true, IsUsageBased: true},
name: "for cloud based usage, Team product (with stripe, no wasm)",
features: proto.Features{Cloud: true, IsUsageBased: true, ProductType: proto.ProductType_PRODUCT_TYPE_TEAM},
urlPath: "/web/index.js",
expectedCspVals: map[string]string{
"default-src": "'self'",
@@ -311,6 +311,22 @@ func TestSetIndexContentSecurityPolicy(t *testing.T) {
"connect-src": "'self' wss:",
},
},
{
name: "for cloud based usage, EUB product (no stripe or wasm)",
features: proto.Features{Cloud: true, IsUsageBased: true, ProductType: proto.ProductType_PRODUCT_TYPE_EUB},
urlPath: "/web/index.js",
expectedCspVals: map[string]string{
"default-src": "'self'",
"base-uri": "'self'",
"form-action": "'self'",
"frame-ancestors": "'none'",
"object-src": "'none'",
"style-src": "'self' 'unsafe-inline'",
"img-src": "'self' data: blob:",
"font-src": "'self' data:",
"connect-src": "'self' wss:",
},
},
{
name: "for desktop session (no stripe, with wasm)",
features: proto.Features{},
@@ -329,8 +345,8 @@ func TestSetIndexContentSecurityPolicy(t *testing.T) {
},
},
{
name: "for cloud based usage & desktop session (with stripe, with wasm)",
features: proto.Features{Cloud: true, IsUsageBased: true},
name: "for cloud based usage & desktop session, Team product (with stripe, with wasm)",
features: proto.Features{Cloud: true, IsUsageBased: true, ProductType: proto.ProductType_PRODUCT_TYPE_TEAM},
urlPath: "/web/cluster/:clusterId/desktops/:desktopName/:username",
expectedCspVals: map[string]string{
"default-src": "'self'",