Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

PIMS-2106: Address WAVA Scan Findings #2781

Merged
merged 3 commits into from
Nov 5, 2024
+47 −20
Merged

PIMS-2106: Address WAVA Scan Findings #2781

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
805e6e2
initial commit
LawrenceLau2020 Oct 31, 2024
ae01cdf
fixing unit test
LawrenceLau2020 Oct 31, 2024
ffee66b
removing maps.googleapis.com
LawrenceLau2020 Oct 31, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion express-api/src/middleware/headerHandler.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
import { NextFunction, Response } from 'express';

const headerHandler: unknown = (req: Request, res: Response, next: NextFunction) => {
res.header('Access-Control-Allow-Origin', '*');
//res.header('Access-Control-Allow-Origin', '*');
res.header('Access-Control-Allow-Methods', 'GET,PUT,PATCH,POST,DELETE');
res.header('Access-Control-Allow-Headers', 'Content-Type, Accept, Authorization');
next();
Expand Down
1 change: 0 additions & 1 deletion express-api/tests/integration/middleware/headerHandler.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,6 @@ describe('INTEGRATION - headerHandler middleware', () => {
it('should set headers with expected values', async () => {
const response = await request.get('/v2/health');
// Remember to use lower case for header keys
expect(response.header['access-control-allow-origin']).toBe('*');
expect(response.header['access-control-allow-methods']).toBe('GET,PUT,PATCH,POST,DELETE');
expect(response.header['access-control-allow-headers']).toBe(
'Content-Type, Accept, Authorization',
Expand Down
42 changes: 24 additions & 18 deletions react-app/index.html
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,22 +1,28 @@
<!doctype html>
<html lang="en">
<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>PIMS</title>
<link
rel="stylesheet"
href="https://unpkg.com/[email protected]/dist/leaflet.css"
integrity="sha256-p4NxAoJBhIIN+hmNHrzRCf9tD/miZyoHS5obTRR9BMY="
crossorigin=""
/>
<link
rel="stylesheet"
href="https://cdnjs.cloudflare.com/ajax/libs/leaflet.draw/1.0.4/leaflet.draw.css"
/>
</head>

<head>
<meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>PIMS</title>
<link rel="stylesheet" href="https://unpkg.com/[email protected]/dist/leaflet.css"
integrity="sha256-p4NxAoJBhIIN+hmNHrzRCf9tD/miZyoHS5obTRR9BMY="
crossorigin=""/>
<link rel="stylesheet" href="//cdnjs.cloudflare.com/ajax/libs/leaflet.draw/1.0.4/leaflet.draw.css"/>
</head>

<body style="margin:0">
<div id="root"></div>
<script type="module" src="/src/index.tsx"></script>
<script src="https://unpkg.com/[email protected]/dist/leaflet.js"
integrity="sha256-20nQCchB9co0qIjJZRGuk2/Z9VM+kNiyxNV1lvTlZBo="
crossorigin=""></script>
</body>

<body style="margin: 0">
<div id="root"></div>
<script type="module" src="/src/index.tsx"></script>
<script
src="https://unpkg.com/[email protected]/dist/leaflet.js"
integrity="sha256-20nQCchB9co0qIjJZRGuk2/Z9VM+kNiyxNV1lvTlZBo="
crossorigin=""
></script>
</body>
</html>
22 changes: 22 additions & 0 deletions react-app/nginx.conf
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,26 @@
server {
# Enable HTTP Strict Transport Security (HSTS) to force clients to always
# connect via HTTPS (do not use if only testing)
add_header Strict-Transport-Security "max-age=31536000;";
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure how this still works with localhost. Doesn't seem to impede it, but it's not https there.


# Enable cross-site filter (XSS) and tell browser to block detected attacks
add_header X-XSS-Protection "1; mode=block";

# Prevent some browsers from MIME-sniffing a response away from the declared Content-Type
add_header X-Content-Type-Options "nosniff";

# Disallow the site to be rendered within a frame (clickjacking protection)
add_header X-Frame-Options "DENY";

add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), fullscreen=()";

# Turn off all caddy caching
add_header Cache-Control "no-cache,no-store,must-revalidate";
add_header Pragma "no-cache";

# Content Security Policy
add_header Content-Security-Policy "default-src 'none'; frame-src 'self' *.gov.bc.ca; script-src 'nonce-windowsp' 'self' *.gov.bc.ca https://maps.googleapis.com https://unpkg.com; style-src 'self' 'unsafe-inline' https://unpkg.com https://cdnjs.cloudflare.com; font-src 'self' *.gov.bc.ca; img-src 'self' *.gov.bc.ca data: tile.openstreetmap.org https://maps.googleapis.com https://unpkg.com https://cdnjs.cloudflare.com https://openmaps.gov.bc.ca; connect-src 'self' *.gov.bc.ca https://openmaps.gov.bc.ca; manifest-src 'self';";
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Where is the maps.googleapis.com used?

Copy link
Collaborator Author

@LawrenceLau2020 LawrenceLau2020 Oct 31, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch, that was probably copied and pasted from the other repo. I can remove it.


listen 3000;
location / {
root /usr/share/nginx/html;
Expand Down
Loading