From 7f55498bcc5c47e9f8e70a7fce44e5c623165641 Mon Sep 17 00:00:00 2001
From: Wolfgang Ginolas <wolfgang.ginolas@gwif.eu>
Date: Tue, 17 Oct 2023 14:09:07 +0200
Subject: [PATCH] Update draw.io dependency and remove unneeded CSP headers

---
 docs/example-advanced.nginx.conf | 4 ++--
 lib/defaults.js                  | 4 ----
 lib/http-worker.js               | 4 ----
 package-lock.json                | 2 +-
 package.json                     | 2 +-
 scripts/copy-components.js       | 2 +-
 www/diagram/inner.js             | 2 +-
 7 files changed, 6 insertions(+), 14 deletions(-)

diff --git a/docs/example-advanced.nginx.conf b/docs/example-advanced.nginx.conf
index b3b8d36f1..16d45087a 100644
--- a/docs/example-advanced.nginx.conf
+++ b/docs/example-advanced.nginx.conf
@@ -163,8 +163,8 @@ server {
     if ($uri ~ ^\/unsafeiframe\/inner\.html.*$) { set $unsafe 1; }
 
     # draw.io uses inline script tags in it's index.html. The hashes are added here.
-    if ($uri ~ ^\/components\/drawio-cp\/src\/main\/webapp\/index.html.*$) {
-        set $scriptSrc "'self' 'sha256-dLMFD7ijAw6AVaqecS7kbPcFFzkxQ+yeZSsKpOdLxps=' 'sha256-6g514VrT/cZFZltSaKxIVNFF46+MFaTSDTPB8WfYK+c=' resource: https://${main_domain}";
+    if ($uri ~ ^\/components\/drawio\/src\/main\/webapp\/index.html.*$) {
+        set $scriptSrc "'self' resource: https://${main_domain}";
     }
 
     # privileged contexts allow a few more rights than unprivileged contexts, though limits are still applied
diff --git a/lib/defaults.js b/lib/defaults.js
index 969842189..ef85e9470 100644
--- a/lib/defaults.js
+++ b/lib/defaults.js
@@ -48,10 +48,6 @@ Default.padContentSecurity = function (Env) {
     return (Default.commonCSP(Env).join('; ') + "script-src 'self' 'unsafe-eval' 'unsafe-inline' resource: " + Env.httpUnsafeOrigin).replace(/\s+/g, ' ');
 };
 
-Default.diagramContentSecurity = function (Env) {
-    return (Default.commonCSP(Env).join('; ') + "script-src 'self' 'sha256-dLMFD7ijAw6AVaqecS7kbPcFFzkxQ+yeZSsKpOdLxps=' 'sha256-6g514VrT/cZFZltSaKxIVNFF46+MFaTSDTPB8WfYK+c=' resource: " + Env.httpUnsafeOrigin).replace(/\s+/g, ' ');
-};
-
 Default.httpHeaders = function (Env) {
     return {
         "X-XSS-Protection": "1; mode=block",
diff --git a/lib/http-worker.js b/lib/http-worker.js
index a88d3d713..8bc11800c 100644
--- a/lib/http-worker.js
+++ b/lib/http-worker.js
@@ -123,8 +123,6 @@ var getHeaders = function (Env, type) {
     var csp;
     if (type === 'office') {
         csp = Default.padContentSecurity(Env);
-    } else if (type === 'diagram') {
-        csp = Default.diagramContentSecurity(Env);
     } else {
         csp = Default.contentSecurity(Env);
     }
@@ -147,8 +145,6 @@ var setHeaders = function (req, res) {
         type = 'office';
     } else if (/^\/api\/(broadcast|config)/.test(req.url)) {
         type = 'api';
-    } else if (/^\/components\/drawio-cp\/src\/main\/webapp\/index.html.*$/.test(req.url)) {
-        type = 'diagram';
     } else {
         type = 'standard';
     }
diff --git a/package-lock.json b/package-lock.json
index 2b6f0c305..46e21f23e 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -23,7 +23,7 @@
         "components-font-awesome": "^4.6.3",
         "croppie": "^2.5.0",
         "dragula": "3.7.2",
-        "drawio-cp": "github:cryptpad/drawio-npm#npm-21.8.2",
+        "drawio": "github:cryptpad/drawio-npm#npm-21.8.2",
         "express": "~4.18.2",
         "file-saver": "1.3.1",
         "fs-extra": "^7.0.0",
diff --git a/package.json b/package.json
index 8ced5f4a5..f1f36b015 100644
--- a/package.json
+++ b/package.json
@@ -59,7 +59,7 @@
     "requirejs-plugins": "^1.0.2",
     "scrypt-async": "1.2.0",
     "sortablejs": "^1.6.0",
-    "drawio-cp": "github:cryptpad/drawio-npm#npm-21.8.2",
+    "drawio": "github:cryptpad/drawio-npm#npm-21.8.2",
     "pako": "^2.1.0",
     "x2js": "^3.4.4"
   },
diff --git a/scripts/copy-components.js b/scripts/copy-components.js
index 24831aca7..cd0903373 100644
--- a/scripts/copy-components.js
+++ b/scripts/copy-components.js
@@ -40,7 +40,7 @@ Fse.rmSync(oldComponentsPath, { recursive: true, force: true });
     "saferphore",
     "nthen",
     "netflux-websocket",
-    "drawio-cp",
+    "drawio",
     "pako",
     "x2js"
 ].forEach(l => {
diff --git a/www/diagram/inner.js b/www/diagram/inner.js
index 4359f45d3..411ad21b6 100644
--- a/www/diagram/inner.js
+++ b/www/diagram/inner.js
@@ -178,7 +178,7 @@ define([
         // starting the CryptPad framework
         framework.start();
 
-        drawioFrame.src = '/components/drawio-cp/src/main/webapp/index.html?'
+        drawioFrame.src = '/components/drawio/src/main/webapp/index.html?'
             + new URLSearchParams({
                 test: 1,
                 stealth: 1,