gnh1201/mastodon
1
0
Fork 0
mirror of https://github.com/mastodon/mastodon.git synced 2025-10-05 16:42:47 +00:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Extract constants for captcha directives/sources (#35439)

Browse Source
This commit is contained in:
Matt Jankowski 2025-07-23 03:55:54 -04:00 committed by GitHub
parent 70058ae49d
commit b19131202f
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
1 changed files with 34 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

47
app/controllers/concerns/auth/captcha_concern.rb
View File

@ -5,6 +5,18 @@ module Auth::CaptchaConcern
include Hcaptcha::Adapters::ViewMethods
CAPTCHA_DIRECTIVES = %w(
connect_src
frame_src
script_src
style_src
).freeze
CAPTCHA_SOURCES = %w(
https://*.hcaptcha.com
https://hcaptcha.com
).freeze
included do
helper_method :render_captcha
end
@ -42,20 +54,9 @@ module Auth::CaptchaConcern
end
def extend_csp_for_captcha!
policy = request.content_security_policy&.clone
return unless captcha_required? && request.content_security_policy.present?
return unless captcha_required? && policy.present?
%w(script_src frame_src style_src connect_src).each do |directive|
values = policy.send(directive)
values << 'https://hcaptcha.com' unless values.include?('https://hcaptcha.com') || values.include?('https:')
values << 'https://*.hcaptcha.com' unless values.include?('https://*.hcaptcha.com') || values.include?('https:')
policy.send(directive, *values)
end
request.content_security_policy = policy
request.content_security_policy = captcha_adjusted_policy
end
def render_captcha
@ -63,4 +64,24 @@ module Auth::CaptchaConcern
hcaptcha_tags
end
private
def captcha_adjusted_policy
request.content_security_policy.clone.tap do |policy|
populate_captcha_policy(policy)
end
end
def populate_captcha_policy(policy)
CAPTCHA_DIRECTIVES.each do |directive|
values = policy.send(directive)
CAPTCHA_SOURCES.each do |source|
values << source unless values.include?(source) || values.include?('https:')
end
policy.send(directive, *values)
end
end
end