mirror of
https://github.com/UNITRONIX/BetterDesk.git
synced 2026-09-10 17:45:42 +00:00
UNITRONIX
bbf839754e
Add multiple security hardenings across the server and web console: enforce proof-of-possession for /ws/bd-mgmt using Ed25519-signed headers with timestamp/nonce and replay protection (public key binding, canonicalization, storage, verification, and tests); remove legacy API key query param and config-table fallback in favor of scoped api_keys (migrate bootstrap key into api_keys); tighten WebSocket origin handling for relay and signal servers to allow only localhost origins by default unless an explicit allowlist is set; update auth middleware public paths and test helpers to use X-API-Key header; add ensureScopedAPIKey migration and related helpers; add a GitHub Secret Scan workflow and an audit report. Misc: propagate audit logging on bd-mgmt connect/disconnect and validate enrollment public keys during device register.
47 lines
1.7 KiB
JavaScript
47 lines
1.7 KiB
JavaScript
const request = require('supertest');
|
|
const { createTestApp } = require('./helpers');
|
|
|
|
const securityMiddleware = require('../middleware/security');
|
|
|
|
function getScriptSrcDirective(cspHeader) {
|
|
const match = cspHeader.match(/script-src ([^;]+)/);
|
|
return match ? match[1] : '';
|
|
}
|
|
|
|
describe('Security Middleware', () => {
|
|
function createSecureApp() {
|
|
const app = createTestApp();
|
|
app.use(securityMiddleware);
|
|
return app;
|
|
}
|
|
|
|
it('sets nonce-based CSP on standard pages without unsafe inline script execution', async () => {
|
|
const app = createSecureApp();
|
|
app.get('/dashboard', (_req, res) => {
|
|
res.send('<html><body>ok</body></html>');
|
|
});
|
|
|
|
const res = await request(app).get('/dashboard');
|
|
const scriptSrc = getScriptSrcDirective(res.headers['content-security-policy']);
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(scriptSrc).toMatch(/'self' 'nonce-[^']+'/);
|
|
expect(scriptSrc).not.toContain("'unsafe-inline'");
|
|
expect(scriptSrc).not.toContain("'unsafe-eval'");
|
|
});
|
|
|
|
it('allows unsafe-eval only on remote viewer routes while still issuing a nonce', async () => {
|
|
const app = createSecureApp();
|
|
app.get('/remote/device-123', (_req, res) => {
|
|
res.send('<html><body>remote</body></html>');
|
|
});
|
|
|
|
const res = await request(app).get('/remote/device-123');
|
|
const scriptSrc = getScriptSrcDirective(res.headers['content-security-policy']);
|
|
|
|
expect(res.status).toBe(200);
|
|
expect(scriptSrc).toMatch(/'self' 'nonce-[^']+'/);
|
|
expect(scriptSrc).toContain("'unsafe-eval'");
|
|
expect(scriptSrc).not.toContain("'unsafe-inline'");
|
|
});
|
|
}); |