Git-Mirrors/onionshare
1
0
Fork 0
mirror of https://github.com/onionshare/onionshare.git synced 2024-10-01 01:35:40 -04:00
Code Issues Packages Projects Releases Wiki Activity

Fix how security headers get added

Browse Source
This commit is contained in:
Miguel Jacq 2019-09-16 12:30:20 +10:00
parent 2524ddaf94
commit 17063e54db
No known key found for this signature in database
GPG Key ID: EEA4341C6D97A0B6
1 changed files with 10 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

25
onionshare/web/web.py
View File

@ -91,6 +91,14 @@ class Web:
# Monkey-patch in the fix from https://github.com/pallets/flask/commit/99c99c4c16b1327288fd76c44bc8635a1de452bc
Flask.select_jinja_autoescape = self._safe_select_jinja_autoescape
self.security_headers = [
('X-Frame-Options', 'DENY'),
('X-Xss-Protection', '1; mode=block'),
('X-Content-Type-Options', 'nosniff'),
('Referrer-Policy', 'no-referrer'),
('Server', 'OnionShare')
]
self.q = queue.Queue()
self.password = None
@ -231,6 +239,8 @@ class Web:
"""
for header, value in self.security_headers:
r.headers.set(header, value)
if self.common.settings.get('csp_header_enabled'):
r.headers.set('Content-Security-Policy', 'default-src \'self\'; style-src \'self\'; script-src \'self\'; img-src \'self\' data:;')
return r
def _safe_select_jinja_autoescape(self, filename):
@ -284,20 +294,6 @@ class Web:
pass
self.running = False
def set_security_headers(self):
"""
Set the security headers for the web service each time we start it.
"""
self.security_headers = [
('X-Frame-Options', 'DENY'),
('X-Xss-Protection', '1; mode=block'),
('X-Content-Type-Options', 'nosniff'),
('Referrer-Policy', 'no-referrer'),
('Server', 'OnionShare')
]
if self.common.settings.get('csp_header_enabled'):
self.security_headers.append(('Content-Security-Policy', 'default-src \'self\'; style-src \'self\'; script-src \'self\'; img-src \'self\' data:;'))
def start(self, port, stay_open=False, public_mode=False, password=None):
"""
Start the flask web server.
@ -320,7 +316,6 @@ class Web:
host = '127.0.0.1'
self.running = True
self.set_security_headers()
self.app.run(host=host, port=port, threaded=True)
def stop(self, port):