Jun 20, 2024 · Jun 20, 2024 · Jun 20, 2024
diff --git a/coderd/coderd.go b/coderd/coderd.go

 // Add CSP headers to all static assets and pages. CSP headers only affect
 // browsers, so these don't make sense on api routes.
 cspMW:=httpmw.CSPHeaders(func() []string {
 cspMW:=httpmw.CSPHeaders(options.Telemetry.Enabled(),func() []string {
 ifapi.DeploymentValues.Dangerous.AllowAllCors {
 // In this mode, allow all external requests
 return []string{"*"}
diff --git a/coderd/httpmw/csp.go b/coderd/httpmw/csp.go
 // CSPHeaders returns a middleware that sets the Content-Security-Policy header
 // for coderd. It takes a function that allows adding supported external websocket
 // hosts. This is primarily to support the terminal connecting to a workspace proxy.
 func CSPHeaders(websocketHosts func() []string) func(next http.Handler) http.Handler {
 //
 //nolint:revive
 func CSPHeaders(telemetry bool, websocketHosts func() []string) func(next http.Handler) http.Handler {
 return func(next http.Handler) http.Handler {
 return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 // Content-Security-Policy disables loading certain content types and can prevent XSS injections.
 // "require-trusted-types-for" : []string{"'script'"},
 }

 if telemetry {
 // If telemetry is enabled, we report to coder.com.
 cspSrcs.Append(cspDirectiveConnectSrc, "https://coder.com")
 }

 // This extra connect-src addition is required to support old webkit
 // based browsers (Safari).
 // See issue: https://github.com/w3c/webappsec-csp/issues/7
diff --git a/coderd/httpmw/csp_test.go b/coderd/httpmw/csp_test.go
 r := httptest.NewRequest(http.MethodGet, "/", nil)
 rw := httptest.NewRecorder()

 httpmw.CSPHeaders(func() []string {
 httpmw.CSPHeaders(false,func() []string {
 return expected
 })(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
 rw.WriteHeader(http.StatusOK)
Original file line number	Diff line number	Diff line change
Expand Up		@@ -1210,7 +1210,7 @@ func New(options Options) API {

		// Add CSP headers to all static assets and pages. CSP headers only affect
		// browsers, so these don't make sense on api routes.
		cspMW:=httpmw.CSPHeaders(func() []string {
		cspMW:=httpmw.CSPHeaders(options.Telemetry.Enabled(),func() []string {
		ifapi.DeploymentValues.Dangerous.AllowAllCors {
		// In this mode, allow all external requests
		return []string{"*"}
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -43,7 +43,9 @@ const (
		// CSPHeaders returns a middleware that sets the Content-Security-Policy header
		// for coderd. It takes a function that allows adding supported external websocket
		// hosts. This is primarily to support the terminal connecting to a workspace proxy.
		func CSPHeaders(websocketHosts func() []string) func(next http.Handler) http.Handler {
		//
		//nolint:revive
		func CSPHeaders(telemetry bool, websocketHosts func() []string) func(next http.Handler) http.Handler {
		return func(next http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		// Content-Security-Policy disables loading certain content types and can prevent XSS injections.
Expand DownExpand Up		@@ -83,6 +85,11 @@ func CSPHeaders(websocketHosts func() []string) func(next http.Handler) http.Han
		// "require-trusted-types-for" : []string{"'script'"},
		}

		if telemetry {
		// If telemetry is enabled, we report to coder.com.
		cspSrcs.Append(cspDirectiveConnectSrc, "https://coder.com")
		}

		// This extra connect-src addition is required to support old webkit
		// based browsers (Safari).
		// See issue: https://github.com/w3c/webappsec-csp/issues/7
Expand Down
Original file line number	Diff line number	Diff line change
Expand Up		@@ -19,7 +19,7 @@ func TestCSPConnect(t *testing.T) {
		r := httptest.NewRequest(http.MethodGet, "/", nil)
		rw := httptest.NewRecorder()

		httpmw.CSPHeaders(func() []string {
		httpmw.CSPHeaders(false,func() []string {
		return expected
		})(http.HandlerFunc(func(rw http.ResponseWriter, r *http.Request) {
		rw.WriteHeader(http.StatusOK)
Expand Down