From 2deb523f3d2bdcf098d20f57060dd0de7e2f11d0 Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Fri, 10 May 2024 14:46:48 +0200 Subject: [PATCH 1/3] backend-app-api: accept camelCase csp directives Signed-off-by: Vincenzo Scamporlino --- packages/backend-app-api/src/http/readHelmetOptions.test.ts | 2 +- packages/backend-app-api/src/http/readHelmetOptions.ts | 6 ++++-- 2 files changed, 5 insertions(+), 3 deletions(-) diff --git a/packages/backend-app-api/src/http/readHelmetOptions.test.ts b/packages/backend-app-api/src/http/readHelmetOptions.test.ts index bc31404634..619a4e6a17 100644 --- a/packages/backend-app-api/src/http/readHelmetOptions.test.ts +++ b/packages/backend-app-api/src/http/readHelmetOptions.test.ts @@ -47,7 +47,7 @@ describe('readHelmetOptions', () => { csp: { key: ['value'], 'img-src': false, - 'script-src-attr': ['custom'], + scriptSrcAttr: ['custom'], }, }); expect(readHelmetOptions(config)).toEqual({ diff --git a/packages/backend-app-api/src/http/readHelmetOptions.ts b/packages/backend-app-api/src/http/readHelmetOptions.ts index 0555bdef00..510fdd9586 100644 --- a/packages/backend-app-api/src/http/readHelmetOptions.ts +++ b/packages/backend-app-api/src/http/readHelmetOptions.ts @@ -18,6 +18,7 @@ import { Config } from '@backstage/config'; import helmet from 'helmet'; import { HelmetOptions } from 'helmet'; import { ContentSecurityPolicyOptions } from 'helmet/dist/types/middlewares/content-security-policy'; +import kebabCase from 'lodash/kebabCase'; /** * Attempts to read Helmet options from the backend configuration object. @@ -97,10 +98,11 @@ export function applyCspDirectives( if (directives) { for (const [key, value] of Object.entries(directives)) { + const kebabCaseKey = kebabCase(key); if (value === false) { - delete result[key]; + delete result[kebabCaseKey]; } else { - result[key] = value; + result[kebabCaseKey] = value; } } } From a1dc547dc41b05092f1bcd733d4bb7602ea6c155 Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Fri, 10 May 2024 14:49:40 +0200 Subject: [PATCH 2/3] backend-app-api: csp changeset Signed-off-by: Vincenzo Scamporlino --- .changeset/olive-pants-leave.md | 11 +++++++++++ 1 file changed, 11 insertions(+) create mode 100644 .changeset/olive-pants-leave.md diff --git a/.changeset/olive-pants-leave.md b/.changeset/olive-pants-leave.md new file mode 100644 index 0000000000..e14cc69912 --- /dev/null +++ b/.changeset/olive-pants-leave.md @@ -0,0 +1,11 @@ +--- +'@backstage/backend-app-api': patch +--- + +Added support for camel case CSP directives in app-config. For example: + +```yaml +backend: + csp: + upgradeInsecureRequests: false +``` From 32e329e23f24c9472ec9fca6b0ac4fc6ff173f5e Mon Sep 17 00:00:00 2001 From: Vincenzo Scamporlino Date: Mon, 13 May 2024 11:41:23 +0200 Subject: [PATCH 3/3] backend-app-api: add missing test Signed-off-by: Vincenzo Scamporlino --- packages/backend-app-api/src/http/readHelmetOptions.test.ts | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/packages/backend-app-api/src/http/readHelmetOptions.test.ts b/packages/backend-app-api/src/http/readHelmetOptions.test.ts index 619a4e6a17..97daef359a 100644 --- a/packages/backend-app-api/src/http/readHelmetOptions.test.ts +++ b/packages/backend-app-api/src/http/readHelmetOptions.test.ts @@ -48,6 +48,7 @@ describe('readHelmetOptions', () => { key: ['value'], 'img-src': false, scriptSrcAttr: ['custom'], + 'object-src': ['asd'], }, }); expect(readHelmetOptions(config)).toEqual({ @@ -58,7 +59,7 @@ describe('readHelmetOptions', () => { 'base-uri': ["'self'"], 'font-src': ["'self'", 'https:', 'data:'], 'frame-ancestors': ["'self'"], - 'object-src': ["'none'"], + 'object-src': ['asd'], 'script-src': ["'self'", "'unsafe-eval'"], 'style-src': ["'self'", 'https:', "'unsafe-inline'"], 'script-src-attr': ['custom'],