From e288402ec4d548648a6bf54a7455332304e9d913 Mon Sep 17 00:00:00 2001
From: Joel Biddle <joel.sven.biddle@gmail.com>
Date: Tue, 22 Aug 2023 17:58:10 +1000
Subject: [PATCH] Properly added pwndpasswords API to CSP

---
 backend/src/index.ts    | 11 +--------
 frontend/next.config.js | 50 ++++++++++++++++++++---------------------
 2 files changed, 26 insertions(+), 35 deletions(-)

diff --git a/backend/src/index.ts b/backend/src/index.ts
index d48a5b97b..098da2aad 100644
--- a/backend/src/index.ts
+++ b/backend/src/index.ts
@@ -132,16 +132,7 @@ const main = async () => {
     // in production
     app.disable("x-powered-by");
     app.use(apiLimiter);
-    app.use(
-      helmet.contentSecurityPolicy({
-        useDefaults: true,
-        directives: {
-          defaultSrc: ["'self'"],
-          imgSrc: ["*", "data:"],
-          connectSrc: ["'self'", "https://api.pwnedpasswords.com/range/"]
-        }
-      })
-    );
+    app.use(helmet());
   }
 
   app.use((req, res, next) => {
diff --git a/frontend/next.config.js b/frontend/next.config.js
index b133818bd..3e9336f15 100644
--- a/frontend/next.config.js
+++ b/frontend/next.config.js
@@ -3,7 +3,7 @@
 /**
  * @type {import('next').NextConfig}
  **/
-const path = require('path');
+const path = require("path");
 
 const ContentSecurityPolicy = `
 	default-src 'self';
@@ -11,7 +11,7 @@ const ContentSecurityPolicy = `
 	style-src 'self' https://rsms.me 'unsafe-inline';
 	child-src https://api.stripe.com;
 	frame-src https://js.stripe.com/ https://api.stripe.com https://www.youtube.com/;
-	connect-src 'self' wss://nexus-websocket-a.intercom.io https://api-iam.intercom.io https://api.heroku.com/ https://id.heroku.com/oauth/authorize https://id.heroku.com/oauth/token https://checkout.stripe.com https://app.posthog.com https://api.stripe.com http://localhost:*;
+	connect-src 'self' wss://nexus-websocket-a.intercom.io https://api-iam.intercom.io https://api.heroku.com/ https://id.heroku.com/oauth/authorize https://id.heroku.com/oauth/token https://checkout.stripe.com https://app.posthog.com https://api.stripe.com https://api.pwnedpasswords.com http://localhost:*;
 	img-src 'self' https://static.intercomassets.com https://js.intercomcdn.com https://downloads.intercomcdn.com https://*.stripe.com https://i.ytimg.com/ data:;
 	media-src https://js.intercomcdn.com;
 	font-src 'self' https://fonts.intercomcdn.com/ https://maxcdn.bootstrapcdn.com https://rsms.me https://fonts.gstatic.com;  
@@ -21,50 +21,50 @@ const ContentSecurityPolicy = `
 // after learning more below.
 const securityHeaders = [
   {
-    key: 'X-DNS-Prefetch-Control',
-    value: 'on'
+    key: "X-DNS-Prefetch-Control",
+    value: "on"
   },
   {
-    key: 'Strict-Transport-Security',
-    value: 'max-age=63072000; includeSubDomains; preload'
+    key: "Strict-Transport-Security",
+    value: "max-age=63072000; includeSubDomains; preload"
   },
   {
-    key: 'X-XSS-Protection',
-    value: '1; mode=block'
+    key: "X-XSS-Protection",
+    value: "1; mode=block"
   },
   {
-    key: 'X-Frame-Options',
-    value: 'SAMEORIGIN'
+    key: "X-Frame-Options",
+    value: "SAMEORIGIN"
   },
   {
-    key: 'Permissions-Policy',
-    value: 'camera=(), microphone=()'
+    key: "Permissions-Policy",
+    value: "camera=(), microphone=()"
   },
   {
-    key: 'X-Content-Type-Options',
-    value: 'nosniff'
+    key: "X-Content-Type-Options",
+    value: "nosniff"
   },
   {
-    key: 'Referrer-Policy',
-    value: 'strict-origin-when-cross-origin'
+    key: "Referrer-Policy",
+    value: "strict-origin-when-cross-origin"
   },
   {
-    key: 'Content-Security-Policy',
-    value: ContentSecurityPolicy.replace(/\s{2,}/g, ' ').trim()
+    key: "Content-Security-Policy",
+    value: ContentSecurityPolicy.replace(/\s{2,}/g, " ").trim()
   }
 ];
 
 module.exports = {
-  output: 'standalone',
+  output: "standalone",
   i18n: {
-    locales: ['en', 'ko', 'fr', 'pt-BR', 'pt-PT', 'es'],
-    defaultLocale: 'en'
+    locales: ["en", "ko", "fr", "pt-BR", "pt-PT", "es"],
+    defaultLocale: "en"
   },
   async headers() {
     return [
       {
         // Apply these headers to all routes in your application.
-        source: '/:path*',
+        source: "/:path*",
         headers: securityHeaders
       }
     ];
@@ -73,15 +73,15 @@ module.exports = {
     // config
     config.module.rules.push({
       test: /\.wasm$/,
-      loader: 'base64-loader',
-      type: 'javascript/auto'
+      loader: "base64-loader",
+      type: "javascript/auto"
     });
 
     config.module.noParse = /\.wasm$/;
 
     config.module.rules.forEach((rule) => {
       (rule.oneOf || []).forEach((oneOf) => {
-        if (oneOf.loader && oneOf.loader.indexOf('file-loader') >= 0) {
+        if (oneOf.loader && oneOf.loader.indexOf("file-loader") >= 0) {
           oneOf.exclude.push(/\.wasm$/);
         }
       });