From 0604b708dc37374414c1b447ceb1d6455260f7a5 Mon Sep 17 00:00:00 2001 From: yflory Date: Wed, 17 Apr 2024 15:12:27 +0200 Subject: [PATCH] Only allow loading onlyoffice fonts + update nginx #1472 --- docs/example-advanced.nginx.conf | 3 +++ lib/http-worker.js | 8 +++----- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf index f2b32e959..d49d8207f 100644 --- a/docs/example-advanced.nginx.conf +++ b/docs/example-advanced.nginx.conf @@ -82,6 +82,9 @@ server { # replace with the IP address of your resolver resolver 8.8.8.8 8.8.4.4 1.1.1.1 1.0.0.1 9.9.9.9 149.112.112.112 208.67.222.222 208.67.220.220; + # OnlyOffice fonts may be loaded from both domains + if ($uri ~ ^\/common\/onlyoffice\/.*\/fonts\/.*$) { set $allowed_origins "*"; } + add_header X-XSS-Protection "1; mode=block"; add_header X-Content-Type-Options nosniff; add_header Access-Control-Allow-Origin "${allowed_origins}"; diff --git a/lib/http-worker.js b/lib/http-worker.js index 418198dec..8b1587a75 100644 --- a/lib/http-worker.js +++ b/lib/http-worker.js @@ -162,12 +162,10 @@ var setHeaders = function (req, res) { var h = getHeaders(Env, type); - // XXX Allow main domain to load resources from the sandbox URL - // We can restrict this to onlyoffice fonts if we find a security issue with this - if (!Env.enableEmbedding && req.get('origin') === Env.httpUnsafeOrigin) { - //if (/^\/common\/onlyoffice\/dist\/.*\/fonts\/.*/.test(req.url)) { + // Allow main domain to load resources from the sandbox URL + if (!Env.enableEmbedding && req.get('origin') === Env.httpUnsafeOrigin && + /^\/common\/onlyoffice\/dist\/.*\/fonts\/.*/.test(req.url)) { h['Access-Control-Allow-Origin'] = Env.httpUnsafeOrigin; - //} } applyHeaderMap(res, h);