Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 3 additions & 5 deletions app/controllers/acuant_sdk_controller.rb
Original file line number Diff line number Diff line change
Expand Up @@ -2,12 +2,12 @@ class AcuantSdkController < ApplicationController
skip_before_action :verify_authenticity_token

ACUANT_SDK_STATIC_FILES = %w[
AcuantImageProcessingService.js.mem
AcuantImageProcessingWorker.min.js
AcuantImageProcessingWorker.wasm
AcuantJavascriptWebSdk.min.js
].freeze

ACUANT_VERSION = '11.4.1'.freeze

def show
# Only render files on an allowlist to prevent path traversal issues
return render(plain: 'Not found', status: :not_found) unless requested_asset_permitted?
Expand All @@ -17,7 +17,7 @@ def show
script_src: ['\'unsafe-eval\''],
)
send_file(
Rails.root.join('public', requested_asset_name),
Rails.root.join('public', 'acuant', ACUANT_VERSION, requested_asset_name),
type: response_content_type,
disposition: :inline,
)
Expand All @@ -40,8 +40,6 @@ def response_content_type
'application/javascript'
when '.wasm'
'application/wasm'
when '.mem'
'application/octet-stream'
end
end
end
2 changes: 1 addition & 1 deletion app/javascript/app/acuant/document_capture.js
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ export const loadAndInitializeAcuantSdk = () => {
window.onAcuantSdkLoaded = initializeAcuantSdk;

const sdk = document.createElement('script');
sdk.src = '11.4.1/AcuantJavascriptWebSdk.min.js';
sdk.src = '/acuant/11.4.1/AcuantJavascriptWebSdk.min.js';
sdk.async = true;

document.body.appendChild(sdk);
Expand Down
2 changes: 1 addition & 1 deletion app/javascript/app/acuant/selfie_capture.js
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ export const loadAndInitializeAcuantSdk = () => {
window.onAcuantSdkLoaded = initializeAcuantSdk;

const sdk = document.createElement('script');
sdk.src = '11.4.1/AcuantJavascriptWebSdk.min.js';
sdk.src = '/acuant/11.4.1/AcuantJavascriptWebSdk.min.js';
sdk.async = true;

document.body.appendChild(sdk);
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ const AcuantContext = createContext({
* @param {AcuantContextProviderProps} props Props object.
*/
function AcuantContextProvider({
sdkSrc = '11.4.1/AcuantJavascriptWebSdk.min.js',
sdkSrc = '/acuant/11.4.1/AcuantJavascriptWebSdk.min.js',
credentials = null,
endpoint = null,
children,
Expand Down
2 changes: 1 addition & 1 deletion spec/javascripts/app/acuant/document_capture_spec.js
Original file line number Diff line number Diff line change
Expand Up @@ -50,7 +50,7 @@ describe('acuant/document_capture', () => {
loadAndInitializeAcuantSdk();

const script = document.querySelector('script');
expect(script.src).to.eq('11.4.1/AcuantJavascriptWebSdk.min.js');
expect(script.src).to.eq('/acuant/11.4.1/AcuantJavascriptWebSdk.min.js');
expect(script.async).to.eq(true);
expect(window.onAcuantSdkLoaded).to.eq(initializeAcuantSdk);
});
Expand Down
30 changes: 8 additions & 22 deletions spec/requests/acuant_sdk_spec.rb
Original file line number Diff line number Diff line change
Expand Up @@ -3,46 +3,32 @@
describe 'requesting acuant SDK assets' do
context 'with a valid Acuant SDK asset' do
it 'renders a JS asset' do
get '/verify/doc_auth/AcuantJavascriptWebSdk.min.js'
get '/verify/doc_auth/AcuantImageProcessingWorker.min.js'

expect(response.status).to eq(200)
expect(response.headers['Content-Type']).to eq('application/javascript')
expect(response.body).to eq(File.read('public/AcuantJavascriptWebSdk.min.js'))
expect(response.body).to eq(
File.read('public/acuant/11.4.1/AcuantImageProcessingWorker.min.js'),
)
end

it 'renders a WASM asset' do
get '/verify/doc_auth/AcuantImageProcessingWorker.wasm'

expect(response.status).to eq(200)
expect(response.headers['Content-Type']).to eq('application/wasm')
expect(response.body.length).to eq(File.size('public/AcuantImageProcessingWorker.wasm'))
end

it 'renders a .js.mem asset' do
get '/verify/doc_auth/AcuantImageProcessingService.js.mem'

expect(response.status).to eq(200)
expect(response.headers['Content-Type']).to eq('application/octet-stream')
expect(response.body.length).to eq(File.size('public/AcuantImageProcessingService.js.mem'))
expect(response.body.length).to eq(
File.size('public/acuant/11.4.1/AcuantImageProcessingWorker.wasm'),
)
end

it 'adds unsafe-eval to the CSP' do
get '/verify/doc_auth/AcuantJavascriptWebSdk.min.js'
get '/verify/doc_auth/AcuantImageProcessingWorker.min.js'

expect(response.headers['Content-Security-Policy']).to match(/script-src[^;]*'unsafe-eval'/)
end
end

context 'with optional version prefix' do
it 'renders an asset' do
get '/verify/doc_auth/11.4.1/AcuantJavascriptWebSdk.min.js'

expect(response.status).to eq(200)
expect(response.headers['Content-Type']).to eq('application/javascript')
expect(response.body).to eq(File.read('public/AcuantJavascriptWebSdk.min.js'))
end
end

context 'with something that is not a valid Acuant SDK asset' do
it 'renders a 404' do
get '/verify/doc_auth/uselss-noise.min.js'
Expand Down