diff --git a/Dockerfile b/Dockerfile index d1d406cd..f2c9163a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,11 +1,10 @@ FROM vibioh/scratch ENV ZONEINFO zoneinfo.zip -EXPOSE 1080 - -ENV KETCHUP_CSP "default-src 'self'; base-uri 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'" ENV KETCHUP_PORT 1080 +EXPOSE 1080 + COPY templates/ /templates COPY static/ /static diff --git a/README.md b/README.md index df93cba3..11414eae 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ Usage of ketchup: -corsOrigin string [cors] Access-Control-Allow-Origin {KETCHUP_CORS_ORIGIN} (default "*") -csp string - [owasp] Content-Security-Policy {KETCHUP_CSP} (default "default-src 'self'; base-uri 'self'") + [owasp] Content-Security-Policy {KETCHUP_CSP} (default "default-src 'self'; base-uri 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'") -dbHost string [db] Host {KETCHUP_DB_HOST} -dbName string diff --git a/cmd/ketchup/api.go b/cmd/ketchup/api.go index 27c4b48d..e3889013 100644 --- a/cmd/ketchup/api.go +++ b/cmd/ketchup/api.go @@ -14,6 +14,7 @@ import ( "github.com/ViBiOh/httputils/v3/pkg/alcotest" "github.com/ViBiOh/httputils/v3/pkg/cors" "github.com/ViBiOh/httputils/v3/pkg/db" + "github.com/ViBiOh/httputils/v3/pkg/flags" "github.com/ViBiOh/httputils/v3/pkg/httputils" "github.com/ViBiOh/httputils/v3/pkg/logger" "github.com/ViBiOh/httputils/v3/pkg/model" @@ -50,7 +51,7 @@ func main() { alcotestConfig := alcotest.Flags(fs, "") loggerConfig := logger.Flags(fs, "logger") prometheusConfig := prometheus.Flags(fs, "prometheus") - owaspConfig := owasp.Flags(fs, "") + owaspConfig := owasp.Flags(fs, "", flags.NewOverride("Csp", "default-src 'self'; base-uri 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'")) corsConfig := cors.Flags(fs, "cors") dbConfig := db.Flags(fs, "db") @@ -97,9 +98,5 @@ func main() { go schedulerApp.Start() go rendererApp.Start() - httputils.New(serverConfig).ListenAndServe(handler, []model.Middleware{ - prometheus.New(prometheusConfig).Middleware, - owasp.New(owaspConfig).Middleware, - cors.New(corsConfig).Middleware, - }, ketchupDb.Ping) + httputils.New(serverConfig).ListenAndServe(handler, []model.Pinger{ketchupDb.Ping}, prometheus.New(prometheusConfig).Middleware, owasp.New(owaspConfig).Middleware, cors.New(corsConfig).Middleware) } diff --git a/go.mod b/go.mod index cfcb1641..b96d3b4c 100644 --- a/go.mod +++ b/go.mod @@ -5,12 +5,11 @@ go 1.15 require ( github.com/DATA-DOG/go-sqlmock v1.5.0 github.com/ViBiOh/auth/v2 v2.5.6 - github.com/ViBiOh/httputils/v3 v3.31.1 + github.com/ViBiOh/httputils/v3 v3.32.0 github.com/ViBiOh/mailer v1.8.2 github.com/lib/pq v1.8.0 github.com/prometheus/common v0.14.0 // indirect github.com/prometheus/procfs v0.2.0 // indirect - github.com/tdewolff/minify/v2 v2.9.7 // indirect golang.org/x/sys v0.0.0-20201007082116-8445cc04cbdf // indirect google.golang.org/protobuf v1.25.0 // indirect ) diff --git a/go.sum b/go.sum index 8b494253..cc1f438d 100644 --- a/go.sum +++ b/go.sum @@ -10,8 +10,8 @@ github.com/ViBiOh/auth/v2 v2.5.6 h1:IPPMKsVK+Rk1pFrikFccEbzqvvZ1EymHayv2nZ9RDVU= github.com/ViBiOh/auth/v2 v2.5.6/go.mod h1:oe4q1yQTRqA2UklKva41gn7zEum60Qkp+YWkuyBii5o= github.com/ViBiOh/httputils/v3 v3.25.1/go.mod h1:KsBEvHr3HAUCV7GwQCP6OdQUJeMP6nnOXLKVS09Pq2U= github.com/ViBiOh/httputils/v3 v3.26.0/go.mod h1:LbWaMuSXrQdIG3fqXKrlyGG/XyS8IOnAT2vpghcjj8Q= -github.com/ViBiOh/httputils/v3 v3.31.1 h1:ZOccueNEU0Q5bMyq1lZUIM5wjvT6cD8tNAZ6H0V0ezY= -github.com/ViBiOh/httputils/v3 v3.31.1/go.mod h1:iKVYtqMvZEZ8X7izFo+VRTirpVYHdcNnLIrfrHmGDjw= +github.com/ViBiOh/httputils/v3 v3.32.0 h1:S1NwU8cmsV3F9/naHf2v6TPfbL5PvkMfjXh0eNW9BOc= +github.com/ViBiOh/httputils/v3 v3.32.0/go.mod h1:IbxKsKy648CmB0UfYloWRDh4pdENvT/s8JiWgYiuLqs= github.com/ViBiOh/mailer v1.8.2 h1:XsmdW9TfaWLu2f4Aj3t3AASlo4e3toN9iBRvz2F7vQg= github.com/ViBiOh/mailer v1.8.2/go.mod h1:iEne7pYmFCm4VnIW5wCbxIaRswRhJHEgsYrxOjzc258= github.com/VividCortex/gohistogram v1.0.0/go.mod h1:Pf5mBqqDxYaXu3hDrrU+w6nw50o/4+TcAqDqk/vUH7g= @@ -272,8 +272,6 @@ github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UV github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4= github.com/tdewolff/minify/v2 v2.9.0/go.mod h1:dkCdk+keSmcckneKfxOgf8/X/3iyCnz1tjIas5Sn1Cs= github.com/tdewolff/minify/v2 v2.9.3/go.mod h1:njYNbXhVTAhI1hARVHCbHAgRd44j+AEt0LdW+menKsY= -github.com/tdewolff/minify/v2 v2.9.6 h1:p6uGI4+s9gufg+HLc2OIwnogGdacYJm8OLQOsZuuu38= -github.com/tdewolff/minify/v2 v2.9.6/go.mod h1:AcJ/ggtHex5N/QiafLI8rlIO3qwSlgbPNLi27VZSYz8= github.com/tdewolff/minify/v2 v2.9.7 h1:r8ewdcX8VYUoNj+s9WSy4FtNNNqNPevWOkb/MksAtzQ= github.com/tdewolff/minify/v2 v2.9.7/go.mod h1:AcJ/ggtHex5N/QiafLI8rlIO3qwSlgbPNLi27VZSYz8= github.com/tdewolff/parse/v2 v2.5.0/go.mod h1:WzaJpRSbwq++EIQHYIRTpbYKNA3gn9it1Ik++q4zyho=