Working Skelleton

2019-03-11 17:03:55 +01:00
commit 8ed2de006d
6779 changed files with 514323 additions and 0 deletions
@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2018 Evan Hahn
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
@@ -0,0 +1,44 @@
+Feature Policy
+==============
+[![Build Status](https://travis-ci.org/helmetjs/feature-policy.svg?branch=master)](https://travis-ci.org/helmetjs/feature-policy)
+
+[_Looking for a changelog?_](https://github.com/helmetjs/helmet/blob/master/HISTORY.md)
+
+This is Express middleware to set the `Feature-Policy` header. You can read more about it [here](https://scotthelme.co.uk/a-new-security-header-feature-policy/) and [here](https://developers.google.com/web/updates/2018/06/feature-policy).
+
+To use:
+
+```javascript
+const featurePolicy = require('feature-policy')
+
+// ...
+
+app.use(featurePolicy({
+  features: {
+    fullscreen: ["'self'"],
+    vibrate: ["'none'"],
+    payment: ['example.com'],
+    syncXhr: ["'none'"]
+  }
+}))
+```
+
+The following features are currently supported:
+
+* `geolocation`
+* `midi`
+* `notifications`
+* `push`
+* `syncXhr`
+* `microphone`
+* `camera`
+* `magnetometer`
+* `gyroscope`
+* `speaker`
+* `vibrate`
+* `fullscreen`
+* `payment`
+* `accelerometer`
+* `usb`
+* `vr`
+* `autoplay`
@@ -0,0 +1,13 @@
+var checkOptions = require('./lib/checkoptions')
+var makePolicy = require('./lib/makepolicy')
+
+module.exports = function featurePolicy (options) {
+  checkOptions(options)
+
+  var policy = makePolicy(options)
+
+  return function featurePolicy (req, res, next) {
+    res.setHeader('Feature-Policy', policy)
+    next()
+  }
+}
@@ -0,0 +1,52 @@
+var config = require('./config')
+
+module.exports = function checkOptions (options) {
+  if (!isObject(options)) {
+    throw new Error('featurePolicy must be called with an object argument. See the documentation.')
+  }
+
+  var features = options.features
+
+  var featuresExist = isObject(features)
+  if (!featuresExist || Object.keys(features).length === 0) {
+    throw new Error('featurePolicy must have at least one feature under the "features" key. See the documentation.')
+  }
+
+  Object.keys(features).forEach(function (feature) {
+    if (!config.features.hasOwnProperty(feature)) {
+      throw new Error('featurePolicy does not support the "' + feature + '" feature.')
+    }
+
+    var value = features[feature]
+
+    if (!Array.isArray(value) || value.length === 0) {
+      throw new Error('The value of the "' + feature + '" feature must be a non-empty array.')
+    }
+
+    var containsStar = false
+    var containsNone = false
+    value.forEach(function (allowed) {
+      if (allowed === '*') {
+        containsStar = true
+      } else if (allowed === "'none'") {
+        containsNone = true
+      } else if (allowed === 'self') {
+        throw new Error("'self' must be quoted.")
+      } else if (allowed === 'none') {
+        throw new Error("'none' must be quoted.")
+      }
+    })
+
+    if (value.length > 1) {
+      if (containsStar) {
+        throw new Error('The value of the "' + feature + '" feature cannot contain * and other values.')
+      } else if (containsNone) {
+        throw new Error('The value of the "' + feature + '" feature cannot contain \'none\' and other values.')
+      }
+    }
+  })
+}
+
+function isObject (value) {
+  return Object.prototype.toString.call(value) === '[object Object]'
+}
@@ -0,0 +1,21 @@
+module.exports = {
+  features: {
+    geolocation: 'geolocation',
+    midi: 'midi',
+    notifications: 'notifications',
+    push: 'push',
+    syncXhr: 'sync-xhr',
+    microphone: 'microphone',
+    camera: 'camera',
+    magnetometer: 'magnetometer',
+    gyroscope: 'gyroscope',
+    speaker: 'speaker',
+    vibrate: 'vibrate',
+    fullscreen: 'fullscreen',
+    payment: 'payment',
+    accelerometer: 'accelerometer',
+    usb: 'usb',
+    vr: 'vr',
+    autoplay: 'autoplay'
+  }
+}
@@ -0,0 +1,8 @@
+var config = require('./config')
+
+module.exports = function makePolicy (options) {
+  return Object.keys(options.features).map(function (featureKey) {
+    const dasherizedKey = config.features[featureKey]
+    return [dasherizedKey].concat(options.features[featureKey]).join(' ')
+  }).join(';')
+}
@@ -0,0 +1,110 @@
+{
+  "_args": [
+    [
+      {
+        "raw": "feature-policy@0.2.0",
+        "scope": null,
+        "escapedName": "feature-policy",
+        "name": "feature-policy",
+        "rawSpec": "0.2.0",
+        "spec": "0.2.0",
+        "type": "version"
+      },
+      "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet"
+    ]
+  ],
+  "_from": "feature-policy@0.2.0",
+  "_hasShrinkwrap": false,
+  "_id": "feature-policy@0.2.0",
+  "_inCache": true,
+  "_location": "/feature-policy",
+  "_nodeVersion": "11.0.0",
+  "_npmOperationalInternal": {
+    "host": "s3://npm-registry-packages",
+    "tmp": "tmp/feature-policy_0.2.0_1541608985922_0.5227434771546264"
+  },
+  "_npmUser": {
+    "name": "evanhahn",
+    "email": "me@evanhahn.com"
+  },
+  "_npmVersion": "6.4.1",
+  "_phantomChildren": {},
+  "_requested": {
+    "raw": "feature-policy@0.2.0",
+    "scope": null,
+    "escapedName": "feature-policy",
+    "name": "feature-policy",
+    "rawSpec": "0.2.0",
+    "spec": "0.2.0",
+    "type": "version"
+  },
+  "_requiredBy": [
+    "/helmet"
+  ],
+  "_resolved": "https://registry.npmjs.org/feature-policy/-/feature-policy-0.2.0.tgz",
+  "_shasum": "22096de49ab240176878ffe2bde2f6ff04d48c43",
+  "_shrinkwrap": null,
+  "_spec": "feature-policy@0.2.0",
+  "_where": "/Users/gerrit/Documents/dev/nodejs/rentfor.camp/html/RentForCamp/node_modules/helmet",
+  "author": {
+    "name": "Evan Hahn",
+    "email": "me@evanhahn.com",
+    "url": "https://evanhahn.com"
+  },
+  "bugs": {
+    "url": "https://github.com/helmetjs/feature-policy/issues"
+  },
+  "dependencies": {},
+  "description": "Middleware to set the Feature-Policy HTTP header",
+  "devDependencies": {
+    "connect": "^3.6.6",
+    "dasherize": "^2.0.0",
+    "mocha": "^5.2.0",
+    "standard": "^12.0.1",
+    "supertest": "^3.3.0"
+  },
+  "directories": {},
+  "dist": {
+    "integrity": "sha512-2hGrlv6efG4hscYVZeaYjpzpT6I2OZgYqE2yDUzeAcKj2D1SH0AsEzqJNXzdoglEddcIXQQYop3lD97XpG75Jw==",
+    "shasum": "22096de49ab240176878ffe2bde2f6ff04d48c43",
+    "tarball": "https://registry.npmjs.org/feature-policy/-/feature-policy-0.2.0.tgz",
+    "fileCount": 7,
+    "unpackedSize": 5689,
+    "npm-signature": "-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.4\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJb4xYaCRA9TVsSAnZWagAALeQP/3Lfs0YecoUqunPJdyGQ\nbHNZE3M1DhPxBI/NTuOwODEVFv0bjwOgmN+ANQ53ZcrsT4R6sT6TvT5L89Xa\nmO03/OpplwsBepCYHDEHG9SEeHSFi3PNIOlW7VqFTYRHoAxi8F1LMTDKNV+W\nhYyWOQ+qeUfh6by2OBAVy8+mMlDuAeSloHVbSqTi1PD19UMVqM2dSoQuLJkG\nxFZfRU8FM0hqTMiWsOUO5JzwGIYS+aj7R1KZqJ520GimJOo37bj+QDUerZgW\nk0hgelZvga0KFm1DlijvUke2k+902ikbRvt9DMwMLd6ZjuTEbzSY+/2+kZ2T\nciu/bzBkGt79lf+tHB/28bLM2h8cy3daTGh2rsun3kOArasroH3NvQPTIBdc\nD4T1abqDl+Y8gKwOkoKmb+nz6Fhmbxgipi1TkHXQviLP7DjCTG8P8rr1qguG\n0uskhyiSTdK4cNvMJSotxhb5eKXqY63BmhLZhbK8TPOJMVQYN6GCGplAU1Fj\nBnY5hAyYV2hxBUPIgZFwo3/3F5xathOBLX/6T9Qj7JJ8wW/NLuQPvSoFhdV5\ng2vyHkT7QSuSiHWw5Wn56J214a1JPIi2aLE1sVKTWAARvzUWXJoQQdxyYRx4\nVqeKLcXzZnkBhXeGf5UqRuNj0G7YMU3vd40EnjwWxxnPCszdmlt47Kd7S6lH\nOAnf\r\n=NOGq\r\n-----END PGP SIGNATURE-----\r\n"
+  },
+  "gitHead": "d007bb86b519e6efb7027cc9325d0d6ce0f8a099",
+  "homepage": "https://github.com/helmetjs/feature-policy#readme",
+  "keywords": [
+    "helmet",
+    "security",
+    "express",
+    "connect",
+    "feature-policy"
+  ],
+  "license": "MIT",
+  "maintainers": [
+    {
+      "name": "evanhahn",
+      "email": "me@evanhahn.com"
+    }
+  ],
+  "name": "feature-policy",
+  "optionalDependencies": {},
+  "readme": "ERROR: No README data found!",
+  "repository": {
+    "type": "git",
+    "url": "git://github.com/helmetjs/feature-policy.git"
+  },
+  "scripts": {
+    "pretest": "standard --fix",
+    "test": "mocha"
+  },
+  "standard": {
+    "globals": [
+      "describe",
+      "beforeEach",
+      "it"
+    ]
+  },
+  "version": "0.2.0"
+}