Skip to content
This repository has been archived by the owner on Feb 12, 2024. It is now read-only.

Commit

Permalink
fix: limit SW registration to content root
Browse files Browse the repository at this point in the history
Introduces hardening proposed in:
ipfs/kubo#4025 (comment)

License: MIT
Signed-off-by: Marcin Rataj <[email protected]>
  • Loading branch information
lidel committed Feb 1, 2020
1 parent 3516bb8 commit dd93dd7
Show file tree
Hide file tree
Showing 2 changed files with 18 additions and 1 deletion.
5 changes: 5 additions & 0 deletions src/http/gateway/resources/gateway.js
Original file line number Diff line number Diff line change
Expand Up @@ -76,6 +76,11 @@ module.exports = {
// add trailing slash for directories with implicit index.html
return h.redirect(`${path}/`).permanent(true)
}
if (request.headers['service-worker'] === 'script') {
// Disallow Service Worker registration on /ipfs scope
// https://github.com/ipfs/go-ipfs/issues/4025
if (path.match(/^\/ip[nf]s\/[^/]+$/)) throw Boom.badRequest('navigator.serviceWorker: registration is not allowed for this scope')
}

// Support If-None-Match & Etag (Conditional Requests from RFC7232)
// https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/ETag
Expand Down
14 changes: 13 additions & 1 deletion test/gateway/index.js
Original file line number Diff line number Diff line change
Expand Up @@ -105,7 +105,7 @@ describe('HTTP Gateway', function () {
expect(res.headers.suborigin).to.equal(undefined)
})

it('400 for request with invalid argument', async () => {
it('returns 400 for request with invalid argument', async () => {
const res = await gateway.inject({
method: 'GET',
url: '/ipfs/invalid'
Expand All @@ -118,6 +118,18 @@ describe('HTTP Gateway', function () {
expect(res.headers.suborigin).to.equal(undefined)
})

it('returns 400 for service worker registration outside of an IPFS content root', async () => {
const res = await gateway.inject({
method: 'GET',
url: '/ipfs/QmT78zSuBmuS4z925WZfrqQ1qHaJ56DQaTfyMUF7F8ff5o?filename=sw.js',
headers: { 'Service-Worker': 'script' }
})

// Expect 400 Bad Request
// https://github.com/ipfs/go-ipfs/issues/4025#issuecomment-342250616
expect(res.statusCode).to.equal(400)
})

it('valid CIDv0', async () => {
const res = await gateway.inject({
method: 'GET',
Expand Down

0 comments on commit dd93dd7

Please sign in to comment.