- redoc CPS issue #1930
- redoc CPS issue #1930
Conversation
WalkthroughThe changes introduce special handling for HTTP requests to the Changes
Sequence Diagram(s)sequenceDiagram
participant Client
participant Server
participant Middleware
Client->>Server: GET /redoc
Server->>Middleware: Process request
Middleware->>Middleware: Deep copy CSP
Middleware->>Middleware: Add worker-src 'blob:' to CSP
Middleware->>Server: Apply modified CSP to response
Middleware->>Middleware: Restore original CSP
Server-->>Client: Response with modified headers
Poem
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Nitpick comments (1)
tests/integration_test/services_test.py (1)
30555-30576: Thoroughly validates /redoc security headers but could be more robust.The test properly verifies that the /redoc endpoint returns the expected security headers, including the modified Content Security Policy with
worker-src blob:which allows RedOc to function correctly. However, the test has some potential issues:
- Asserting the exact
content-lengthvalue (498) makes the test brittle - this value will likely change if the response content is modified.- Hard-coding all header values increases maintenance overhead as any future change to security headers will require updating this test.
Consider making the test more robust with these changes:
def test_redoc_headers(): response = client.get("/redoc") assert response.status_code == 200 - assert response.headers == { - "content-length": "498", - "content-type": "text/html; charset=utf-8", + # Verify critical security headers + assert "worker-src blob:" in response.headers["content-security-policy"] + assert response.headers["x-frame-options"] == "SAMEORIGIN" + assert response.headers["strict-transport-security"] == "includeSubDomains; preload; max-age=31536000" + + # Check other expected headers exist without exact value matching + expected_headers = [ "content-type", "content-encoding", - "vary": "Accept-Encoding", - "server": "Secure", - "strict-transport-security": "includeSubDomains; preload; max-age=31536000", - "x-frame-options": "SAMEORIGIN", - "x-xss-protection": "0", - "x-content-type-options": "nosniff", - "content-security-policy": "default-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; connect-src 'self'; frame-src 'self'; style-src 'self' https: 'unsafe-inline'; img-src 'self' https:; script-src 'self' https: 'unsafe-inline'; worker-src blob:", - "referrer-policy": "no-referrer", - "cache-control": "must-revalidate", - "permissions-policy": "accelerometer=(), autoplay=(), camera=(), document-domain=(), encrypted-media=(), fullscreen=(), vibrate=(), geolocation=(), gyroscope=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), sync-xhr=(), usb=()", - "cross-origin-embedder-policy": "require-corp", - "cross-origin-opener-policy": "same-origin", - "cross-origin-resource-policy": "same-origin", - "access-control-allow-origin": "*" - } + "vary", + "server", + "x-xss-protection", + "x-content-type-options", + "referrer-policy", + "cache-control", + "permissions-policy", + "cross-origin-embedder-policy", + "cross-origin-opener-policy", + "cross-origin-resource-policy", + "access-control-allow-origin" + ] + for header in expected_headers: + assert header in response.headers + + # Optionally verify response contains expected RedOc content + assert "swagger-ui" in response.text or "redoc" in response.text
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro
📒 Files selected for processing (5)
kairon/actions/server.py(2 hunks)kairon/api/app/main.py(2 hunks)kairon/chat/server.py(2 hunks)kairon/events/server.py(2 hunks)tests/integration_test/services_test.py(1 hunks)
⏰ Context from checks skipped due to timeout of 90000ms (3)
- GitHub Check: Codacy Static Code Analysis
- GitHub Check: Analyze (python)
- GitHub Check: Python CI
🔇 Additional comments (8)
kairon/actions/server.py (2)
3-3: Added import for deep copying CSP.The
copymodule is imported to support the deep copying of the Content Security Policy object for the/redocendpoint.
135-141: Properly modified CSP for/redocendpoint.This implementation correctly creates a deep copy of the CSP, adds the necessary
worker-src blob:directive specifically for the/redocendpoint, and then restores the original CSP after applying the headers. This approach ensures other endpoints maintain the stricter CSP.kairon/chat/server.py (2)
2-2: Added import for deep copying CSP.The
copymodule is imported to support the deep copying of the Content Security Policy object for the/redocendpoint.
111-117: Properly modified CSP for/redocendpoint.This implementation correctly creates a deep copy of the CSP, adds the necessary
worker-src blob:directive specifically for the/redocendpoint, and then restores the original CSP after applying the headers. This approach ensures other endpoints maintain the stricter CSP.kairon/events/server.py (2)
1-1: Added import for deep copying CSP.The
copymodule is imported to support the deep copying of the Content Security Policy object for the/redocendpoint.
90-96: Properly modified CSP for/redocendpoint.This implementation correctly creates a deep copy of the CSP, adds the necessary
worker-src blob:directive specifically for the/redocendpoint, and then restores the original CSP after applying the headers. This approach ensures other endpoints maintain the stricter CSP.kairon/api/app/main.py (2)
1-1: Added import for deep copying CSP.The
copymodule is imported to support the deep copying of the Content Security Policy object for the/redocendpoint.
102-108: Properly modified CSP for/redocendpoint.This implementation correctly creates a deep copy of the CSP, adds the necessary
worker-src blob:directive specifically for the/redocendpoint, and then restores the original CSP after applying the headers. This approach ensures other endpoints maintain the stricter CSP.
Summary by CodeRabbit
Bug Fixes
/redocendpoint to allow worker scripts from blob URLs, ensuring proper functionality of the documentation page without affecting other endpoints.Tests
/redocendpoint returns the correct set of security and response headers.