Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

DCXY-25579 generate importMap hash for CSP #798

Draft
wants to merge 3 commits into
base: stage
Choose a base branch
from
Draft

DCXY-25579 generate importMap hash for CSP #798

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
87f9b05
generate importMap hash for CSP
peller Sep 11, 2024
f448391
Merge branch 'stage' into import-map-hash
peller Sep 11, 2024
1246aec
Merge branch 'stage' into import-map-hash
peller Sep 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions edgeworkers/Acrobat_DC_web_prod/main.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -92,11 +92,22 @@ export async function responseProvider(request) {
throw new Error('Missing metadata');
}

const snippet =
await fetchResource(`/dc/dc-generate-cache/dc-hosted-${version}/${verb}-${locale}.html`);
const [
snippet,
importMap,
] = await Promise.all([
fetchResource(`/dc/dc-generate-cache/dc-hosted-${version}/${verb}-${locale}.html`),
fetchResource(`/dc/dc-hosted/${widgetVersion}/import-map-${ isProd ? 'prod' : 'stage' }.json`),
]);

const snippetHead = snippet.substring(snippet.indexOf('<head>')+6, snippet.indexOf('</head>'));
const snippetBody = snippet.substring(snippet.indexOf('<body>')+6, snippet.indexOf('</body>'));

// Generate hash of importMap and add to our CSP policy. importMap will be injected at runtime
const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(importMap));
const hash64 = btoa(String.fromCharCode(...new Uint8Array(hash)));
scriptHashes.push(`'sha256-${hash64}'`);

rewriter.onElement('head', el => {
el.append(snippetHead);
});
Expand All @@ -118,7 +129,7 @@ export async function responseProvider(request) {
] = await Promise.all([
fetchResource('/acrobat/scripts/scripts.js'),
fetchResource('/acrobat/blocks/dc-converter-widget/dc-converter-widget.js'),
])
]);

// Inline dc-converter-widget.js and scripts.js. Remove modular definition and import.
// Change relative paths to absolute. Remove JS-driven CSP in favor of HTTP header.
Expand All @@ -128,7 +139,7 @@ export async function responseProvider(request) {
+ scripts
.replace('const { default: dcConverter } = await import(`../blocks/${blockName}/${blockName}.js`);', '')
.replace('await import(\'./contentSecurityPolicy/csp.js\')', '{default:()=>{}}')
.replace('await import(\'./dcLana.js\')', 'await import(\'/acrobat/scripts/dcLana.js\')')
.replace('await import(\'./dcLana.js\')', 'await import(\'/acrobat/scripts/dcLana.js\')');

// Generate hash of inlined script and add to our CSP policy
const hash = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(inlineScript));
Expand Down
Loading