diff --git a/app/controllers/acuant_sdk_controller.rb b/app/controllers/acuant_sdk_controller.rb index 5b06325cd1a..dfa6c76fa38 100644 --- a/app/controllers/acuant_sdk_controller.rb +++ b/app/controllers/acuant_sdk_controller.rb @@ -2,12 +2,12 @@ class AcuantSdkController < ApplicationController skip_before_action :verify_authenticity_token ACUANT_SDK_STATIC_FILES = %w[ - AcuantImageProcessingService.js.mem AcuantImageProcessingWorker.min.js AcuantImageProcessingWorker.wasm - AcuantJavascriptWebSdk.min.js ].freeze + ACUANT_VERSION = '11.4.1'.freeze + def show # Only render files on an allowlist to prevent path traversal issues return render(plain: 'Not found', status: :not_found) unless requested_asset_permitted? @@ -17,7 +17,7 @@ def show script_src: ['\'unsafe-eval\''], ) send_file( - Rails.root.join('public', requested_asset_name), + Rails.root.join('public', 'acuant', ACUANT_VERSION, requested_asset_name), type: response_content_type, disposition: :inline, ) @@ -40,8 +40,6 @@ def response_content_type 'application/javascript' when '.wasm' 'application/wasm' - when '.mem' - 'application/octet-stream' end end end diff --git a/app/javascript/app/acuant/document_capture.js b/app/javascript/app/acuant/document_capture.js index b6f60c44fef..b1adb10cfae 100644 --- a/app/javascript/app/acuant/document_capture.js +++ b/app/javascript/app/acuant/document_capture.js @@ -50,7 +50,7 @@ export const loadAndInitializeAcuantSdk = () => { window.onAcuantSdkLoaded = initializeAcuantSdk; const sdk = document.createElement('script'); - sdk.src = '11.4.1/AcuantJavascriptWebSdk.min.js'; + sdk.src = '/acuant/11.4.1/AcuantJavascriptWebSdk.min.js'; sdk.async = true; document.body.appendChild(sdk); diff --git a/app/javascript/app/acuant/selfie_capture.js b/app/javascript/app/acuant/selfie_capture.js index 3ad22ef1652..a0ea9147ac9 100644 --- a/app/javascript/app/acuant/selfie_capture.js +++ b/app/javascript/app/acuant/selfie_capture.js @@ -43,7 +43,7 @@ export const loadAndInitializeAcuantSdk = () => { window.onAcuantSdkLoaded = initializeAcuantSdk; const sdk = document.createElement('script'); - sdk.src = '11.4.1/AcuantJavascriptWebSdk.min.js'; + sdk.src = '/acuant/11.4.1/AcuantJavascriptWebSdk.min.js'; sdk.async = true; document.body.appendChild(sdk); diff --git a/app/javascript/packages/document-capture/context/acuant.jsx b/app/javascript/packages/document-capture/context/acuant.jsx index 5f94a1e4b9c..803908c3d77 100644 --- a/app/javascript/packages/document-capture/context/acuant.jsx +++ b/app/javascript/packages/document-capture/context/acuant.jsx @@ -58,7 +58,7 @@ const AcuantContext = createContext({ * @param {AcuantContextProviderProps} props Props object. */ function AcuantContextProvider({ - sdkSrc = '11.4.1/AcuantJavascriptWebSdk.min.js', + sdkSrc = '/acuant/11.4.1/AcuantJavascriptWebSdk.min.js', credentials = null, endpoint = null, children, diff --git a/public/AcuantImageProcessingService.js.mem b/public/acuant/11.4.1/AcuantImageProcessingService.js.mem similarity index 100% rename from public/AcuantImageProcessingService.js.mem rename to public/acuant/11.4.1/AcuantImageProcessingService.js.mem diff --git a/public/AcuantImageProcessingWorker.min.js b/public/acuant/11.4.1/AcuantImageProcessingWorker.min.js similarity index 100% rename from public/AcuantImageProcessingWorker.min.js rename to public/acuant/11.4.1/AcuantImageProcessingWorker.min.js diff --git a/public/AcuantImageProcessingWorker.wasm b/public/acuant/11.4.1/AcuantImageProcessingWorker.wasm similarity index 100% rename from public/AcuantImageProcessingWorker.wasm rename to public/acuant/11.4.1/AcuantImageProcessingWorker.wasm diff --git a/public/AcuantJavascriptWebSdk.min.js b/public/acuant/11.4.1/AcuantJavascriptWebSdk.min.js similarity index 100% rename from public/AcuantJavascriptWebSdk.min.js rename to public/acuant/11.4.1/AcuantJavascriptWebSdk.min.js diff --git a/spec/javascripts/app/acuant/document_capture_spec.js b/spec/javascripts/app/acuant/document_capture_spec.js index 950a18c17b9..c0d91030b53 100644 --- a/spec/javascripts/app/acuant/document_capture_spec.js +++ b/spec/javascripts/app/acuant/document_capture_spec.js @@ -50,7 +50,7 @@ describe('acuant/document_capture', () => { loadAndInitializeAcuantSdk(); const script = document.querySelector('script'); - expect(script.src).to.eq('11.4.1/AcuantJavascriptWebSdk.min.js'); + expect(script.src).to.eq('/acuant/11.4.1/AcuantJavascriptWebSdk.min.js'); expect(script.async).to.eq(true); expect(window.onAcuantSdkLoaded).to.eq(initializeAcuantSdk); }); diff --git a/spec/requests/acuant_sdk_spec.rb b/spec/requests/acuant_sdk_spec.rb index 54aa88e138c..34b294a6ba1 100644 --- a/spec/requests/acuant_sdk_spec.rb +++ b/spec/requests/acuant_sdk_spec.rb @@ -3,11 +3,13 @@ describe 'requesting acuant SDK assets' do context 'with a valid Acuant SDK asset' do it 'renders a JS asset' do - get '/verify/doc_auth/AcuantJavascriptWebSdk.min.js' + get '/verify/doc_auth/AcuantImageProcessingWorker.min.js' expect(response.status).to eq(200) expect(response.headers['Content-Type']).to eq('application/javascript') - expect(response.body).to eq(File.read('public/AcuantJavascriptWebSdk.min.js')) + expect(response.body).to eq( + File.read('public/acuant/11.4.1/AcuantImageProcessingWorker.min.js'), + ) end it 'renders a WASM asset' do @@ -15,34 +17,18 @@ expect(response.status).to eq(200) expect(response.headers['Content-Type']).to eq('application/wasm') - expect(response.body.length).to eq(File.size('public/AcuantImageProcessingWorker.wasm')) - end - - it 'renders a .js.mem asset' do - get '/verify/doc_auth/AcuantImageProcessingService.js.mem' - - expect(response.status).to eq(200) - expect(response.headers['Content-Type']).to eq('application/octet-stream') - expect(response.body.length).to eq(File.size('public/AcuantImageProcessingService.js.mem')) + expect(response.body.length).to eq( + File.size('public/acuant/11.4.1/AcuantImageProcessingWorker.wasm'), + ) end it 'adds unsafe-eval to the CSP' do - get '/verify/doc_auth/AcuantJavascriptWebSdk.min.js' + get '/verify/doc_auth/AcuantImageProcessingWorker.min.js' expect(response.headers['Content-Security-Policy']).to match(/script-src[^;]*'unsafe-eval'/) end end - context 'with optional version prefix' do - it 'renders an asset' do - get '/verify/doc_auth/11.4.1/AcuantJavascriptWebSdk.min.js' - - expect(response.status).to eq(200) - expect(response.headers['Content-Type']).to eq('application/javascript') - expect(response.body).to eq(File.read('public/AcuantJavascriptWebSdk.min.js')) - end - end - context 'with something that is not a valid Acuant SDK asset' do it 'renders a 404' do get '/verify/doc_auth/uselss-noise.min.js'