53 lines
2.1 KiB
Ruby
53 lines
2.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
# GitLab lightweight base action controller
|
|
#
|
|
# This class should be limited to content that
|
|
# is desired/required for *all* controllers in
|
|
# GitLab.
|
|
#
|
|
# Most controllers inherit from `ApplicationController`.
|
|
# Some controllers don't want or need all of that
|
|
# logic and instead inherit from `ActionController::Base`.
|
|
# This makes it difficult to set security headers and
|
|
# handle other critical logic across *all* controllers.
|
|
#
|
|
# Between this controller and `ApplicationController`
|
|
# no controller should ever inherit directly from
|
|
# `ActionController::Base`
|
|
#
|
|
# rubocop:disable Rails/ApplicationController -- This class is specifically meant as a base class for controllers that
|
|
# don't inherit from ApplicationController
|
|
# rubocop:disable Gitlab/NamespacedClass -- Base controllers live in the global namespace
|
|
class BaseActionController < ActionController::Base
|
|
extend ContentSecurityPolicyPatch
|
|
|
|
content_security_policy do |p|
|
|
next if p.directives.blank?
|
|
|
|
if helpers.vite_enabled?
|
|
vite_port = ViteRuby.instance.config.port
|
|
vite_origin = "#{Gitlab.config.gitlab.host}:#{vite_port}"
|
|
http_origin = "http://#{vite_origin}"
|
|
ws_origin = "ws://#{vite_origin}"
|
|
wss_origin = "wss://#{vite_origin}"
|
|
gitlab_ws_origin = Gitlab::Utils.append_path(Gitlab.config.gitlab.url, 'vite-dev/')
|
|
http_path = Gitlab::Utils.append_path(http_origin, 'vite-dev/')
|
|
|
|
connect_sources = p.directives['connect-src']
|
|
p.connect_src(*(Array.wrap(connect_sources) | [ws_origin, wss_origin, http_path]))
|
|
|
|
worker_sources = p.directives['worker-src']
|
|
p.worker_src(*(Array.wrap(worker_sources) | [gitlab_ws_origin, http_path]))
|
|
end
|
|
|
|
next unless Gitlab::CurrentSettings.snowplow_enabled? && !Gitlab::CurrentSettings.snowplow_collector_hostname.blank?
|
|
|
|
default_connect_src = p.directives['connect-src'] || p.directives['default-src']
|
|
connect_src_values = Array.wrap(default_connect_src) | [Gitlab::CurrentSettings.snowplow_collector_hostname]
|
|
p.connect_src(*connect_src_values)
|
|
end
|
|
end
|
|
# rubocop:enable Gitlab/NamespacedClass
|
|
# rubocop:enable Rails/ApplicationController
|