blob: e251c44f63d13da347ee0b44d98390a61994dec0 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
|
# frozen_string_literal: true
# GitLab lightweight base action controller
#
# This class should be limited to content that
# is desired/required for *all* controllers in
# GitLab.
#
# Most controllers inherit from `ApplicationController`.
# Some controllers don't want or need all of that
# logic and instead inherit from `ActionController::Base`.
# This makes it difficult to set security headers and
# handle other critical logic across *all* controllers.
#
# Between this controller and `ApplicationController`
# no controller should ever inherit directly from
# `ActionController::Base`
#
# rubocop:disable Rails/ApplicationController -- This class is specifically meant as a base class for controllers that
# don't inherit from ApplicationController
# rubocop:disable Gitlab/NamespacedClass -- Base controllers live in the global namespace
class BaseActionController < ActionController::Base
extend ContentSecurityPolicyPatch
content_security_policy do |p|
next if p.directives.blank?
if helpers.vite_enabled?
vite_port = ViteRuby.instance.config.port
vite_origin = "#{Gitlab.config.gitlab.host}:#{vite_port}"
http_origin = "http://#{vite_origin}"
ws_origin = "ws://#{vite_origin}"
wss_origin = "wss://#{vite_origin}"
gitlab_ws_origin = Gitlab::Utils.append_path(Gitlab.config.gitlab.url, 'vite-dev/')
http_path = Gitlab::Utils.append_path(http_origin, 'vite-dev/')
connect_sources = p.directives['connect-src']
p.connect_src(*(Array.wrap(connect_sources) | [ws_origin, wss_origin, http_path]))
worker_sources = p.directives['worker-src']
p.worker_src(*(Array.wrap(worker_sources) | [gitlab_ws_origin, http_path]))
end
next unless Gitlab::CurrentSettings.snowplow_enabled? && !Gitlab::CurrentSettings.snowplow_collector_hostname.blank?
default_connect_src = p.directives['connect-src'] || p.directives['default-src']
connect_src_values = Array.wrap(default_connect_src) | [Gitlab::CurrentSettings.snowplow_collector_hostname]
p.connect_src(*connect_src_values)
end
end
# rubocop:enable Gitlab/NamespacedClass
# rubocop:enable Rails/ApplicationController
|
