Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Added parentheses for permissions policy parser according issue #195

Closed
wants to merge 1 commit into from

Conversation

ccxdev
Copy link

@ccxdev ccxdev commented Aug 9, 2023

Fixes: #194

@vercel
Copy link

vercel bot commented Aug 9, 2023

The latest updates on your projects. Learn more about Vercel for Git ↗︎

Name Status Preview Comments Updated (UTC)
nuxt-security ✅ Ready (Inspect) Visit Preview 💬 Add feedback Aug 9, 2023 10:51am

@Baroshem
Copy link
Collaborator

Baroshem commented Aug 10, 2023

Hey,

When I tried this PR with default configuration it does not work correctly and throws an error in the browser console
image

Tested with following config:

    permissionsPolicy: {
      'camera': ['()'],
      'display-capture': ['()'],
      'fullscreen': ['()'],
      'geolocation': ['()'],
      'microphone': ['()'],
    }

It generates following headers:

Permissions-Policy:
camera=(()), display-capture=(()), fullscreen=(()), geolocation=(()), microphone=(())

@ccxdev
Copy link
Author

ccxdev commented Aug 10, 2023

@Baroshem

By default permissionsPolicy already set to (). Is it's necessary handle overriding default values with default values ?

@Baroshem
Copy link
Collaborator

@nekotoriy I meant that I was using the default config.

With changes from your PR, the the module is not working correctly in terms of permissions policy. It may work for your case, but it does not work with the default config or when the user will pass just a single ['()'] as value for certain policy.

I think you would have to add some condition to the parser to only add additional parentheses when value passes is an array with multiple elements.

@ccxdev
Copy link
Author

ccxdev commented Aug 10, 2023

But in this case, passing ["self"] will not work. Because output would be camera=self

@Baroshem
Copy link
Collaborator

Hey @nekotoriy

sorry for no response but I was on holidays.

In this case we have two options then:

  1. Change the current behavior to add parenteses automatically (it will be a Breaking Change)
  2. Adjust the behavior to work for your case and for the previous approaches

From my perspective, the better would be the option two as it wont break the functionality for the current users.

However, the option one might be better for the future so we could plan it for the 1.0.0 version where we could ship breaking changes.

Let me know which option would work better from your side and we can think about it :)

@ccxdev
Copy link
Author

ccxdev commented Aug 22, 2023

Hello @Baroshem!

At the moment I don't have an urgent need to fix this bug, so we can schedule break changes for version 1.0.0 following the first point.

@Baroshem
Copy link
Collaborator

@nekotoriy

Ok, so I will add this fix to the plan for 1.0.0 and we will work on it in the upcoming weeks :)

@ccxdev
Copy link
Author

ccxdev commented Aug 24, 2023

Alright, thank you!

@Baroshem Baroshem changed the base branch from main to chore/1.0.0-rc.1 September 21, 2023 11:09
@Baroshem
Copy link
Collaborator

Hey @nekotoriy

I have changed the target branch to 1.0.0-rc.1 as I want to include this functionality in the upcoming 1.0.0-rc.1 release.

I have tested it and it seems to be working as expected :)

Object.entries(value)
.map(
([directive, sources]) =>
(sources as string[])?.length &&
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: here you can safely delete the checking for length as we will allow for empty arrays that will be translated to ()

@@ -41,7 +41,15 @@ const headerValueMappers = {
})
.filter(Boolean).join('; ')
},
permissionsPolicy: (value: PermissionsPolicyValue) => Object.entries(value).map(([directive, sources]) => (sources as string[])?.length && `${directive}=${(sources as string[]).join(' ')}`).filter(Boolean).join(', ')
permissionsPolicy: (value: PermissionsPolicyValue) =>
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

issue: please change defaultConfig.ts value for permissionsPolicy from the existing one to:

    permissionsPolicy: {
      camera: [],
      'display-capture': [],
      fullscreen: [],
      geolocation: [],
      microphone: []
    }

This with the addition of the next comment would allow to have both () and your functionality :)

@Baroshem
Copy link
Collaborator

Hey @nekotoriy

Do you need any help with the implementation. I can do this if you dont have time (I will still mention you in the release notes as the contributor so no worries about that :) )

@Baroshem
Copy link
Collaborator

@nekotoriy Are you planning to add the changes I mentioned? If you dont have time, just let me know. I will add the changes and include you in the release notes :)

@Baroshem
Copy link
Collaborator

Closing in favor of #212

@Baroshem Baroshem closed this Oct 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Invalid permission policy parser
2 participants