From 7784c6cf095c65efd71729351e74db851a228ca4 Mon Sep 17 00:00:00 2001
From: Nicolas CARPi
Date: Thu, 27 May 2021 11:24:09 +0200
Subject: [PATCH 1/3] start improving security
---
Dockerfile | 5 +-
apache/000-default.conf | 16 +++
demos/index.html | 258 +---------------------------------------
demos/index.js | 240 +++++++++++++++++++++++++++++++++++++
4 files changed, 260 insertions(+), 259 deletions(-)
create mode 100644 apache/000-default.conf
create mode 100644 demos/index.js
diff --git a/Dockerfile b/Dockerfile
index 1787574..cc86316 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -21,11 +21,12 @@ RUN apt-get update && apt-get -y --no-install-recommends install gnupg \
&& curl -sL https://deb.nodesource.com/setup_14.x | bash - \
&& apt-get install -y nodejs \
&& npm install -g documentation \
- && rm -rf /var/lib/apt/lists/*
+ && rm -rf /var/lib/apt/lists/* \
+ && a2enmod headers
COPY . /var/www/html
RUN ln -s /var/www/html/src /var/www/html/demos/src
-RUN sed -i -e "s:/var/www/html:/var/www/html/demos:" /etc/apache2/sites-enabled/000-default.conf
+COPY ./apache/000-default.conf /etc/apache2/sites-enabled/000-default.conf
# generate api doc
WORKDIR /var/www/html
diff --git a/apache/000-default.conf b/apache/000-default.conf
new file mode 100644
index 0000000..8379d2e
--- /dev/null
+++ b/apache/000-default.conf
@@ -0,0 +1,16 @@
+
+ ServerName jeditable.elabftw.net
+
+ ServerAdmin webmaster@localhost
+ DocumentRoot /var/www/html/demos
+
+ ErrorLog ${APACHE_LOG_DIR}/error.log
+ CustomLog ${APACHE_LOG_DIR}/access.log combined
+
+ Header always set Strict-Transport-Security "max-age=63072000"
+ Header always set X-xss-protection "0"
+ Header always set X-content-type-options "nosniff"
+ Header always set Content-Security-Policy "default-src 'self' data:; script-src 'self' https://ajax.googleapis.com https://code.jquery.com; connect-src 'self'; img-src 'self'; style-src 'self' 'unsafe-inline' https://code.jquery.com https://maxcdn.bootstrapcdn.com https://use.fontawesome.com; font-src 'self' data: https://use.fontawesome.com https://maxcdn.bootstrapcdn.com; object-src 'self'; base-uri 'none'; frame-ancestors 'none'"
+ Header always set Referrer-policy "no-referrer"
+ Header always set Feature-policy "autoplay 'none'; camera 'none'; document-domain 'none'; encrypted-media 'none'; fullscreen 'self'; geolocation 'none'; microphone 'none'; midi 'none'; payment 'none'; vr 'none'"
+
diff --git a/demos/index.html b/demos/index.html
index b8df69e..1f8cc92 100644
--- a/demos/index.html
+++ b/demos/index.html
@@ -470,263 +470,7 @@ Show source code
-
-
-
-
-
-
-
+