Skip to content

Commit 15a2ee4

Browse files
authored
deps: update to wabac.js 2.22.15 for improved CSP hardening (#417)
bump to 2.3.6
1 parent e2c3f69 commit 15a2ee4

File tree

4 files changed

+64
-6
lines changed

4 files changed

+64
-6
lines changed

CHANGES.md

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,12 @@
11
<!-- cSpell:ignoreRegExp @\w+ -->
22

33
## CHANGES
4+
5+
v2.3.6
6+
7+
- Security: Improved CSP policy again, block loading of iframes outsides of replay (via wabac.js 2.22.15)
8+
- Tests: Update tests to check CSP behavior
9+
410
v2.3.5
511

612
- Fidelity: Update to wabac.js 2.22.14, various fidelity improvements

package.json

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
{
22
"name": "replaywebpage",
33
"productName": "ReplayWeb.page",
4-
"version": "2.3.5",
4+
"version": "2.3.6",
55
"description": "Serverless Web Archive Replay",
66
"repository": "https://github.com/webrecorder/replayweb.page",
77
"homepage": "https://replayweb.page/",
@@ -22,7 +22,7 @@
2222
"dependencies": {
2323
"@fortawesome/fontawesome-free": "^5.15.4",
2424
"@shoelace-style/shoelace": "~2.15.1",
25-
"@webrecorder/wabac": "^2.22.14",
25+
"@webrecorder/wabac": "^2.22.15",
2626
"bulma": "^0.9.3",
2727
"electron-log": "^4.4.1",
2828
"electron-updater": "^6.3.9",

tests/embeds.spec.js

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,3 +72,55 @@ test("require subdomain iframe", async ({ page }) => {
7272
"Sorry, due to security settings, this ReplayWeb.page embed only be viewed within a subdomain iframe.",
7373
);
7474
});
75+
76+
test("csp blocking in place", async ({ page }) => {
77+
await page.goto("http://localhost:9990/embed.html");
78+
79+
const frame = page
80+
.locator("replay-web-page")
81+
.frameLocator("iframe")
82+
.locator("replay-app-main wr-item wr-coll-replay")
83+
.frameLocator("iframe")
84+
.locator(":root");
85+
86+
const didNotFetch = await frame.evaluate(async () => {
87+
const blocked = async (win, url) => {
88+
try {
89+
const resp = await win.fetch(url);
90+
if (!resp.ok) {
91+
return 1;
92+
}
93+
return 0;
94+
} catch (e) {
95+
return 1;
96+
}
97+
};
98+
99+
let block = 0;
100+
101+
// blocks (1 - 3)
102+
block += await blocked(window, "https://webrecorder.net/");
103+
block += await blocked(window, "http://localhost:9990/ui.js");
104+
block += await blocked(window, "http://localhost:9990/sw.js");
105+
106+
const iframe = document.createElement("iframe");
107+
iframe.src = "http://localhost:9990/static/wombat.js";
108+
document.body.appendChild(iframe);
109+
110+
await new Promise((resolve) => setTimeout(resolve, 1000));
111+
112+
// (4) still blocked from loading due to csp
113+
block += await blocked(iframe.contentWindow, "https://webrecorder.net/");
114+
115+
// (5-6) blocked by csp policy, even though local
116+
block += await blocked(iframe.contentWindow, "http://localhost:9990/sw.js");
117+
block += await blocked(
118+
iframe.contentWindow,
119+
"http://localhost:9990/static/wombat.js",
120+
);
121+
122+
return block;
123+
});
124+
125+
expect(didNotFetch).toBe(6);
126+
});

yarn.lock

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1028,10 +1028,10 @@
10281028
resolved "https://registry.yarnpkg.com/@webpack-cli/serve/-/serve-2.0.5.tgz#325db42395cd49fe6c14057f9a900e427df8810e"
10291029
integrity sha512-lqaoKnRYBdo1UgDX8uF24AfGMifWK19TxPmM5FHc2vAGxrJ/qtyUyFBWoY1tISZdelsQ5fBcOusifo5o5wSJxQ==
10301030

1031-
"@webrecorder/wabac@^2.22.14":
1032-
version "2.22.14"
1033-
resolved "https://registry.yarnpkg.com/@webrecorder/wabac/-/wabac-2.22.14.tgz#6f7503c2f06d126a1fb1ff754ce081836602e202"
1034-
integrity sha512-dcomAtul8dML/fJZjQNqRCWVLjirmuJPqPDNFv/7hFsm9SUHt9LdbXytQqndCWqCPvu6RVA4lfdXSA4O8erClQ==
1031+
"@webrecorder/wabac@^2.22.15":
1032+
version "2.22.15"
1033+
resolved "https://registry.yarnpkg.com/@webrecorder/wabac/-/wabac-2.22.15.tgz#2b5c31cf16fdd2055e7bae331fa26488359df9cd"
1034+
integrity sha512-GJvFNCnDdvpij1mBNRRpT4zfr66W5td4NpNKEPmBtEwTPdlRyNlU96ZSL3NRVtzvg7RG6LpI6Oa86lKd6EUpBA==
10351035
dependencies:
10361036
"@peculiar/asn1-ecc" "^2.3.4"
10371037
"@peculiar/asn1-schema" "^2.3.3"

0 commit comments

Comments
 (0)