Project rename

2019-03-24 08:28:57 +01:00
parent 1728e0e6e1
commit 7926230faf
7262 changed files with 0 additions and 0 deletions
@@ -0,0 +1,4 @@
+language: node_js
+node_js:
+  - "6"
+  - "10"
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014-2018 Evan Hahn, Adam Baldwin
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,26 @@
+X-Permitted-Cross-Domain-Policies middleware
+============================================
+[![Build Status](https://travis-ci.org/helmetjs/crossdomain.svg?branch=master)](https://travis-ci.org/helmetjs/crossdomain)
+
+[_Looking for a changelog?_](https://github.com/helmetjs/helmet/blob/master/HISTORY.md)
+
+The `X-Permitted-Cross-Domain-Policies` header tells some web clients (like Adobe Flash or Adobe Acrobat) your domain's policy for loading cross-domain content. See the description on [OWASP](https://www.owasp.org/index.php/OWASP_Secure_Headers_Project#X-Permitted-Cross-Domain-Policies) for more.
+
+Usage:
+
+```javascript
+const crossdomain = require('helmet-crossdomain')
+
+// Sets X-Permitted-Cross-Domain-Policies: none
+app.use(crossdomain())
+
+// You can use any of the following values:
+app.use(crossdomain({ permittedPolicies: 'none' }))
+app.use(crossdomain({ permittedPolicies: 'master-only' }))
+app.use(crossdomain({ permittedPolicies: 'by-content-type' }))
+app.use(crossdomain({ permittedPolicies: 'all' }))
+```
+
+The `by-ftp-type` is not currently supported. Please open an issue or pull request if you desire this feature!
+
+If you don't expect Adobe products to load data from your site, you get a minor security benefit by adding this header.
@@ -0,0 +1,27 @@
+var DEFAULT_PERMITTED_POLICIES = 'none'
+var ALLOWED_POLICIES = [
+  'none',
+  'master-only',
+  'by-content-type',
+  'all'
+]
+
+module.exports = function crossdomain (options) {
+  options = options || {}
+
+  var permittedPolicies
+  if ('permittedPolicies' in options) {
+    permittedPolicies = options.permittedPolicies
+  } else {
+    permittedPolicies = DEFAULT_PERMITTED_POLICIES
+  }
+
+  if (ALLOWED_POLICIES.indexOf(permittedPolicies) === -1) {
+    throw new Error('"' + permittedPolicies + '" is not a valid permitted policy. Allowed values: ' + ALLOWED_POLICIES.join(', ') + '.')
+  }
+
+  return function crossdomain (req, res, next) {
+    res.setHeader('X-Permitted-Cross-Domain-Policies', permittedPolicies)
+    next()
+  }
+}
@@ -0,0 +1,111 @@
+{
+  "_args": [
+    [
+      {
+        "raw": "helmet-crossdomain@0.3.0",
+        "scope": null,
+        "escapedName": "helmet-crossdomain",
+        "name": "helmet-crossdomain",
+        "rawSpec": "0.3.0",
+        "spec": "0.3.0",
+        "type": "version"
+      },
+      "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet"
+    ]
+  ],
+  "_from": "helmet-crossdomain@0.3.0",
+  "_id": "helmet-crossdomain@0.3.0",
+  "_inCache": true,
+  "_location": "/helmet-crossdomain",
+  "_nodeVersion": "10.5.0",
+  "_npmOperationalInternal": {
+    "host": "s3://npm-registry-packages",
+    "tmp": "tmp/helmet-crossdomain_0.3.0_1532286097523_0.8741214484328683"
+  },
+  "_npmUser": {
+    "name": "evanhahn",
+    "email": "me@evanhahn.com"
+  },
+  "_npmVersion": "6.2.0",
+  "_phantomChildren": {},
+  "_requested": {
+    "raw": "helmet-crossdomain@0.3.0",
+    "scope": null,
+    "escapedName": "helmet-crossdomain",
+    "name": "helmet-crossdomain",
+    "rawSpec": "0.3.0",
+    "spec": "0.3.0",
+    "type": "version"
+  },
+  "_requiredBy": [
+    "/helmet"
+  ],
+  "_resolved": "https://registry.npmjs.org/helmet-crossdomain/-/helmet-crossdomain-0.3.0.tgz",
+  "_shasum": "707e2df930f13ad61f76ed08e1bb51ab2b2e85fa",
+  "_shrinkwrap": null,
+  "_spec": "helmet-crossdomain@0.3.0",
+  "_where": "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet",
+  "author": {
+    "name": "Evan Hahn",
+    "email": "me@evanhahn.com",
+    "url": "https://evanhahn.com"
+  },
+  "bugs": {
+    "url": "https://github.com/helmetjs/crossdomain/issues"
+  },
+  "dependencies": {},
+  "description": "Set the X-Permitted-Cross-Domain-Policies header in Express apps",
+  "devDependencies": {
+    "connect": "^3.6.6",
+    "mocha": "^5.2.0",
+    "standard": "^11.0.1",
+    "supertest": "^3.1.0"
+  },
+  "directories": {},
+  "dist": {
+    "integrity": "sha512-YiXhj0E35nC4Na5EPE4mTfoXMf9JTGpN4OtB4aLqShKuH9d2HNaJX5MQoglO6STVka0uMsHyG5lCut5Kzsy7Lg==",
+    "shasum": "707e2df930f13ad61f76ed08e1bb51ab2b2e85fa",
+    "tarball": "https://registry.npmjs.org/helmet-crossdomain/-/helmet-crossdomain-0.3.0.tgz",
+    "fileCount": 6,
+    "unpackedSize": 6335,
+    "npm-signature": "-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJbVNSRCRA9TVsSAnZWagAAEVQP/jzk1uye0ikRyhTxFLaY\n1mv8ce3abISEHNNxi+cdXvYnd/KTr25oXnws9eHIhCmPTMabwNpqLQrjzLo9\nXdyQhhBr5A/FXZ4hr2PzF8g65zbxiPWBjDQghPYeGHA64atHw/AXKcX5a3l4\nDliodao8XGGeO+RayESkDT0tRuEeh0T8igtXNRhgpih+ezGMO9SxcNVNW1cJ\n3UymWtMKqVUwASvdVHMQCLTAZn4jxCEdbscy+V5hPqCXRpUnvAAB4vSm3Kig\nLAnA55z3zx7HEn0WtM2CEUalROovheAvS1fY+4r+AKAi6tc5t5fZoXyOJKBW\nu82PTrUJSxO3xf2WYjovFlkt6MdOt8YzWVUTDLkQ8LW/yQwOSXa2A27orRJj\nQZDRVhpTl5b3RyhwmtoIqQ8r2q1afl5DhHTk5Bem3QhWp3ssi534e0zADHqI\njfK4nL97JQi3xx4byAV3RJhc6Qo04iVy95NBLvufwuLzAMdSYPLlFwIZpprw\nCZTrcYMzUqnrpizkyC0uQDcIR5D/AcsE0n6lAahBrORsb9jG95Ke7ti0ouFH\nfA/9VcxielKrFFjTNjNHDX0OPu4iQ3IluVKgiYwLtSn33sXhxnFwYu+0bW/Y\nBwsLPt+I046b7GgjmV7ewHuph8Xgnc09wVCrr5O2oLYJzzPhWDG/h2E4sE7Y\nFYI4\r\n=Pwa4\r\n-----END PGP SIGNATURE-----\r\n"
+  },
+  "engines": {
+    "node": ">= 6"
+  },
+  "gitHead": "6f1891d7a02b3c745b47817e3550df4947b78cab",
+  "homepage": "https://github.com/helmetjs/crossdomain#readme",
+  "keywords": [
+    "security",
+    "express",
+    "connect",
+    "crossdomain.xml",
+    "x-permitted-cross-domain-policies",
+    "flash"
+  ],
+  "license": "MIT",
+  "maintainers": [
+    {
+      "name": "evanhahn",
+      "email": "me@evanhahn.com"
+    }
+  ],
+  "name": "helmet-crossdomain",
+  "optionalDependencies": {},
+  "readme": "ERROR: No README data found!",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/helmetjs/crossdomain.git"
+  },
+  "scripts": {
+    "pretest": "standard --fix",
+    "test": "mocha"
+  },
+  "standard": {
+    "globals": [
+      "describe",
+      "it"
+    ]
+  },
+  "version": "0.3.0"
+}
@@ -0,0 +1,71 @@
+const crossdomain = require('..')
+
+const assert = require('assert')
+const connect = require('connect')
+const request = require('supertest')
+
+describe('crossdomain', function () {
+  function app (middleware) {
+    const result = connect()
+    result.use(middleware)
+    result.use((req, res) => { res.end('Hello world') })
+    return result
+  }
+
+  it('sets X-Permitted-Cross-Domain-Policies: none when called with no arguments', () => {
+    return request(app(crossdomain()))
+      .get('/')
+      .expect('X-Permitted-Cross-Domain-Policies', 'none')
+      .expect('Hello world')
+  })
+
+  it('sets X-Permitted-Cross-Domain-Policies: none when called with an empty object', () => {
+    return request(app(crossdomain({})))
+      .get('/')
+      .expect('X-Permitted-Cross-Domain-Policies', 'none')
+      .expect('Hello world')
+  })
+
+  it('can explicitly set the policy to "none"', () => {
+    return request(app(crossdomain({ permittedPolicies: 'none' })))
+      .get('/')
+      .expect('X-Permitted-Cross-Domain-Policies', 'none')
+      .expect('Hello world')
+  })
+
+  it('can set the policy to "master-only"', () => {
+    return request(app(crossdomain({ permittedPolicies: 'master-only' })))
+      .get('/')
+      .expect('X-Permitted-Cross-Domain-Policies', 'master-only')
+      .expect('Hello world')
+  })
+
+  it('can set the policy to "by-content-type"', () => {
+    return request(app(crossdomain({ permittedPolicies: 'by-content-type' })))
+      .get('/')
+      .expect('X-Permitted-Cross-Domain-Policies', 'by-content-type')
+      .expect('Hello world')
+  })
+
+  it('can set the policy to "all"', () => {
+    return request(app(crossdomain({ permittedPolicies: 'all' })))
+      .get('/')
+      .expect('X-Permitted-Cross-Domain-Policies', 'all')
+      .expect('Hello world')
+  })
+
+  it('cannot set the policy to "by-ftp-filename"', () => {
+    assert.throws(() => { crossdomain({ permittedPolicies: 'by-ftp-filename' }) })
+  })
+
+  it('cannot set the policy to invalid values', function () {
+    assert.throws(() => { crossdomain({ permittedPolicies: '' }) })
+    assert.throws(() => { crossdomain({ permittedPolicies: null }) })
+    assert.throws(() => { crossdomain({ permittedPolicies: 'NONE' }) })
+  })
+
+  it('names its function and middleware', function () {
+    assert.equal(crossdomain.name, 'crossdomain')
+    assert.equal(crossdomain().name, 'crossdomain')
+  })
+})