cleanup csp

stargately · Oct 31, 2020 · 8fbf53d · 8fbf53d
1 parent c0e648c
commit 8fbf53d
Show file tree

Hide file tree

Showing 5 changed files with 8 additions and 17 deletions.
diff --git a/packages/web-server/src/middleware/csp/csp.js b/packages/web-server/src/middleware/csp/csp.js
@@ -3,18 +3,11 @@ import filterEffectiveAttr, { effectiveAttr } from "./filterEffectiveAttr";
 import repareKeyWords from "./repareKeyWords";
 import * as log from "./log";
 
-/**
- * @desc 生成一条策略的字符串
- *
- * @return {String} 'default-src self'
- */
 function generateSubPolicyStr(policy) {
   return policy.map(repareKeyWords).join(" ");
 }
 
-// 默认配置-只允许该域名下内容
 const defaultParams = {
-  // 是否显示警告信息
   enableWarn: true,
   policy: {
     "default-src": ["self"],
@@ -34,9 +27,9 @@ function validatorPolicy(policy) {
 }
 
 /**
- * @desc 设置响应头 Content-Security-Policy
+ * @desc Content-Security-Policy
  *
- * @param customPolicy {Object} 自定义安全策略 exp. { 'img-src': ['self'] };
+ * @param customPolicy {Object} exp. { 'img-src': ['self'] };
  */
 export default function ({ enableWarn = true, policy = {} } = defaultParams) {
   return async (ctx, next) => {

diff --git a/packages/web-server/src/middleware/csp/filterEffectiveAttr.js b/packages/web-server/src/middleware/csp/filterEffectiveAttr.js
@@ -1,4 +1,3 @@
-// 有效的安全策略命名
 export const effectiveAttr = [
   "default-src",
   "child-src",
@@ -16,8 +15,7 @@ export const effectiveAttr = [
 ];
 
 /**
- * @desc 过滤无效安全策略并格式化
- *       有效策略命名参照 effectiveAttr
+ * @desc filter invalid policies and format them
  *
  * @return {Array} exp. [['default-src', 'self'], ['img-src', 'self']]
  */

diff --git a/packages/web-server/src/middleware/csp/repareKeyWords.js b/packages/web-server/src/middleware/csp/repareKeyWords.js
@@ -1,6 +1,6 @@
 const keyWords = ["none", "self", "unsafe-inline", "unsafe-eval"];
 
-// 修复字符串self的书写问题 "self" => "'self'"
+// convert "self" => "'self'"
 export default function (str) {
   return keyWords.includes(str) ? `'${str}'` : str;
 }
diff --git a/packages/web-server/src/middleware/middleware.ts b/packages/web-server/src/middleware/middleware.ts
@@ -5,14 +5,14 @@ import { isoReactRenderMiddleware } from "../iso-react-render/iso-react-render-m
 import { Server } from "../server";
 import { Context, Middleware, Next } from "../types";
 import { cookieSessionMiddleware } from "./cookie-session-middleware";
-// @ts-ignore
-import csp from "./csp/csp";
 import { csrfMiddleware, isPrefixMatched } from "./csrf-middleware";
 import { initI18nMiddleware } from "./i18n-middleware";
 import { staticServe } from "./static-serve";
 import { uncaughtErrorMiddleware } from "./uncaught-error-middleware";
 import { viewBaseState } from "./view-base-state";
 
+const csp = require("./csp/csp");
+
 export function initMiddleware(server: Server): void {
   server.use(uncaughtErrorMiddleware(server));
 
@@ -38,7 +38,6 @@ export function initMiddleware(server: Server): void {
 
   // security headers
   const { noSecurityHeadersRoutes } = server.config.server;
-  // @ts-ignore
   server.use(
     htmlOnlyMiddleware({
       postFunc: async (ctx: Context, _: Next) => {

diff --git a/packages/web-server/tsconfig.json b/packages/web-server/tsconfig.json
@@ -31,7 +31,8 @@
     // "emitDecoratorMetadata": true /* Enables experimental support for emitting type metadata for decorators. */,
     "lib": ["es7", "es6", "dom", "esnext"],
     "types": ["node"],
-    "typeRoots": ["node_modules/@types", "src/types"]
+    "typeRoots": ["node_modules/@types", "src/types"],
+    "skipLibCheck": true
   },
   "include": ["src/**/*.ts", "src/**/*.tsx"],
   "exclude": ["node_modules/**"],