| 1 | package docs |
| 2 | |
| 3 | import "amadan.net/rastrillo/rastrillo" |
| 4 | |
| 5 | // ContentSecurityPolicy is the policy Docs serves (cmd/docs sets it as |
| 6 | // rastrillo.Options.CSP). It is rastrillo's default as of the |
| 7 | // 2026-09-08 pin, which allowed inline styles. rastrillo's default |
| 8 | // dropped 'unsafe-inline' from style-src on 2026-09-13 (c7e1a09), and |
| 9 | // Docs draws its pages with <style> blocks (list, show, share, the |
| 10 | // jump-to partial) and one style attribute (home_link.html); under the |
| 11 | // new default every one of them is blocked and the app renders |
| 12 | // unstyled, with no error anywhere. Moving them to stylesheets is its |
| 13 | // own piece of work; until then this keeps Docs' behaviour exactly as |
| 14 | // it was. |
| 15 | const ContentSecurityPolicy = "default-src 'self'; style-src 'self' 'unsafe-inline'; " + |
| 16 | "img-src 'self' data:; frame-ancestors 'none'; base-uri 'self'; form-action 'self'" |
| 17 | |
| 18 | // Browsers enforce form-action through a form's redirect chain. Linking starts |
| 19 | // with a local POST and reaches Home; allow only the validated credential origin. |
| 20 | // The drift test pins every other directive to ContentSecurityPolicy. |
| 21 | func homeFormPolicy(issuer string) string { |
| 22 | return ContentSecurityPolicy + " " + issuer |
| 23 | } |
| 24 | |
| 25 | // ServeOptions fills in what cmd/docs hands rastrillo.Serve for this |
| 26 | // app: the router, the error page, the locales and catalog, and the |
| 27 | // policy above. One function, so the test that serves pages through |
| 28 | // rastrillo's production middleware (TestServedPolicyAllowsThePagesInlineStyles) |
| 29 | // serves them exactly as the binary does. |
| 30 | func ServeOptions(opts rastrillo.Options, app *App) rastrillo.Options { |
| 31 | opts.Mux = app.Handler() |
| 32 | // A panic outside the router's signed-in group (which has its own |
| 33 | // recoverer) still gets the error page rather than plain text. |
| 34 | opts.ErrorPage = app.ErrorPage |
| 35 | opts.DBPath = "" |
| 36 | opts.Locales = Locales |
| 37 | opts.DefaultLocale = DefaultLocale |
| 38 | opts.BaseCatalog = Catalog |
| 39 | // Docs' own policy, not rastrillo's default, which no longer allows |
| 40 | // the inline styles Docs' pages are drawn with (see its comment). |
| 41 | opts.CSP = ContentSecurityPolicy |
| 42 | return opts |
| 43 | } |
| 44 | |
amadan