Skip to content

Commit 4cd5834

Browse files
JaredCEJaredCE
committed
add example to the owasp schema
1 parent fca088b commit 4cd5834

File tree

1 file changed

+147
-118
lines changed

1 file changed

+147
-118
lines changed

‎src/owasp.js‎

Lines changed: 147 additions & 118 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
'use strict'
1+
"use strict";
22

3-
const https = require('https')
3+
const https = require("https");
44

5-
const defaultOWASP = require('../json/owasp.json')
5+
const defaultOWASP = require("../json/owasp.json");
66

77
/**
88
* @typedef {Object} Header
@@ -17,125 +17,154 @@ const defaultOWASP = require('../json/owasp.json')
1717
*/
1818

1919
class OWASP {
20-
constructor() {
21-
this.DEFAULT_OWASP_HEADERS = {
22-
"Cache-Control": {
23-
description: 'The Cache-Control HTTP header field holds directives (instructions) — in both requests and responses — that control [caching](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) in browsers and shared caches (e.g. Proxies, CDNs). - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control)',
24-
},
25-
"Clear-Site-Data": {
26-
description: 'The Clear-Site-Data header clears browsing data (cookies, storage, cache) associated with the requesting website. It allows web developers to have more control over the data stored by a client browser for their origins. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data)',
27-
},
28-
"Content-Security-Policy": {
29-
description: 'The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks ([Cross-site scripting](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)). - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)',
30-
},
31-
"Cross-Origin-Embedder-Policy": {
32-
description: 'The HTTP Cross-Origin-Embedder-Policy (COEP) response header configures embedding cross-origin resources into the document. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy)',
33-
},
34-
"Cross-Origin-Opener-Policy": {
35-
description: 'The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy)',
36-
},
37-
"Cross-Origin-Resource-Policy": {
38-
description: 'Cross-Origin Resource Policy is a policy set by the Cross-Origin-Resource-Policy HTTP header that lets websites and applications opt in to protection against certain requests from other origins (such as those issued with elements like <script> and <img>), to mitigate speculative side-channel attacks, like Spectre, as well as Cross-Site Script Inclusion attacks. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy)',
39-
},
40-
"Permissions-Policy": {
41-
description: 'The HTTP Permissions-Policy header provides a mechanism to allow and deny the use of browser features in a document or within any [<iframe>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) elements in the document. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy)',
42-
},
43-
"Pragma": {
44-
description: 'The Pragma HTTP/1.0 general header is an implementation-specific header that may have various effects along the request-response chain. This header serves for backwards compatibility with the HTTP/1.0 caches that do not have a [Cache-Control](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) HTTP/1.1 header. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pragma)',
45-
deprecated: true,
46-
},
47-
"Referrer-Policy": {
48-
description: 'The Referrer-Policy [HTTP header](https://developer.mozilla.org/en-US/docs/Glossary/HTTP_header) controls how much [referrer information](https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns) (sent with the [Referer](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) header) should be included with requests. Aside from the HTTP header, you can [set this policy in HTML](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#integration_with_html). - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy)',
49-
},
50-
"Strict-Transport-Security": {
51-
description: 'The HTTP Strict-Transport-Security response header (often abbreviated as [HSTS](https://developer.mozilla.org/en-US/docs/Glossary/HSTS)) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security)',
52-
},
53-
"X-Content-Type-Options": {
54-
description: 'The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the [MIME types](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types) advertised in the [Content-Type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type) headers should be followed and not be changed. The header allows you to avoid [MIME type sniffing](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing) by saying that the MIME types are deliberately configured. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options)',
55-
},
56-
"X-Frame-Options": {
57-
description: 'The X-Frame-Options [HTTP](https://developer.mozilla.org/en-US/docs/Web/HTTP) response header can be used to indicate whether or not a browser should be allowed to render a page in a [<frame>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/frame), [<iframe>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe), [<embed>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/embed) or [<object>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/object). Sites can use this to avoid [click-jacking](https://developer.mozilla.org/en-US/docs/Web/Security/Types_of_attacks#click-jacking) attacks, by ensuring that their content is not embedded into other sites. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)',
58-
},
59-
"X-Permitted-Cross-Domain-Policies": {
60-
description: "A cross-domain policy file is an XML document that grants a web client, such as Adobe Flash Player or Adobe Acrobat (though not necessarily limited to these), permission to handle data across domains. When clients request content hosted on a particular source domain and that content makes requests directed towards a domain other than its own, the remote domain needs to host a cross-domain policy file that grants access to the source domain, allowing the client to continue the transaction. Normally a meta-policy is declared in the master policy file, but for those who can't write to the root directory, they can also declare a meta-policy using the X-Permitted-Cross-Domain-Policies HTTP response header. - [OWASP Link](https://owasp.org/www-project-secure-headers/#x-permitted-cross-domain-policies)",
20+
constructor() {
21+
this.DEFAULT_OWASP_HEADERS = {
22+
"Cache-Control": {
23+
description:
24+
"The Cache-Control HTTP header field holds directives (instructions) — in both requests and responses — that control [caching](https://developer.mozilla.org/en-US/docs/Web/HTTP/Caching) in browsers and shared caches (e.g. Proxies, CDNs). - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control)",
25+
},
26+
"Clear-Site-Data": {
27+
description:
28+
"The Clear-Site-Data header clears browsing data (cookies, storage, cache) associated with the requesting website. It allows web developers to have more control over the data stored by a client browser for their origins. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Clear-Site-Data)",
29+
},
30+
"Content-Security-Policy": {
31+
description:
32+
"The HTTP Content-Security-Policy response header allows website administrators to control resources the user agent is allowed to load for a given page. With a few exceptions, policies mostly involve specifying server origins and script endpoints. This helps guard against cross-site scripting attacks ([Cross-site scripting](https://developer.mozilla.org/en-US/docs/Glossary/Cross-site_scripting)). - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy)",
33+
},
34+
"Cross-Origin-Embedder-Policy": {
35+
description:
36+
"The HTTP Cross-Origin-Embedder-Policy (COEP) response header configures embedding cross-origin resources into the document. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Embedder-Policy)",
37+
},
38+
"Cross-Origin-Opener-Policy": {
39+
description:
40+
"The HTTP Cross-Origin-Opener-Policy (COOP) response header allows you to ensure a top-level document does not share a browsing context group with cross-origin documents. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Opener-Policy)",
41+
},
42+
"Cross-Origin-Resource-Policy": {
43+
description:
44+
"Cross-Origin Resource Policy is a policy set by the Cross-Origin-Resource-Policy HTTP header that lets websites and applications opt in to protection against certain requests from other origins (such as those issued with elements like <script> and <img>), to mitigate speculative side-channel attacks, like Spectre, as well as Cross-Site Script Inclusion attacks. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cross-Origin-Resource-Policy)",
45+
},
46+
"Permissions-Policy": {
47+
description:
48+
"The HTTP Permissions-Policy header provides a mechanism to allow and deny the use of browser features in a document or within any [<iframe>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe) elements in the document. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Permissions-Policy)",
49+
},
50+
Pragma: {
51+
description:
52+
"The Pragma HTTP/1.0 general header is an implementation-specific header that may have various effects along the request-response chain. This header serves for backwards compatibility with the HTTP/1.0 caches that do not have a [Cache-Control](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Cache-Control) HTTP/1.1 header. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Pragma)",
53+
deprecated: true,
54+
},
55+
"Referrer-Policy": {
56+
description:
57+
"The Referrer-Policy [HTTP header](https://developer.mozilla.org/en-US/docs/Glossary/HTTP_header) controls how much [referrer information](https://developer.mozilla.org/en-US/docs/Web/Security/Referer_header:_privacy_and_security_concerns) (sent with the [Referer](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referer) header) should be included with requests. Aside from the HTTP header, you can [set this policy in HTML](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy#integration_with_html). - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Referrer-Policy)",
58+
},
59+
"Strict-Transport-Security": {
60+
description:
61+
"The HTTP Strict-Transport-Security response header (often abbreviated as [HSTS](https://developer.mozilla.org/en-US/docs/Glossary/HSTS)) informs browsers that the site should only be accessed using HTTPS, and that any future attempts to access it using HTTP should automatically be converted to HTTPS. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Strict-Transport-Security)",
62+
},
63+
"X-Content-Type-Options": {
64+
description:
65+
"The X-Content-Type-Options response HTTP header is a marker used by the server to indicate that the [MIME types](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types) advertised in the [Content-Type](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Type) headers should be followed and not be changed. The header allows you to avoid [MIME type sniffing](https://developer.mozilla.org/en-US/docs/Web/HTTP/Basics_of_HTTP/MIME_types#mime_sniffing) by saying that the MIME types are deliberately configured. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Content-Type-Options)",
66+
},
67+
"X-Frame-Options": {
68+
description:
69+
"The X-Frame-Options [HTTP](https://developer.mozilla.org/en-US/docs/Web/HTTP) response header can be used to indicate whether or not a browser should be allowed to render a page in a [<frame>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/frame), [<iframe>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/iframe), [<embed>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/embed) or [<object>](https://developer.mozilla.org/en-US/docs/Web/HTML/Element/object). Sites can use this to avoid [click-jacking](https://developer.mozilla.org/en-US/docs/Web/Security/Types_of_attacks#click-jacking) attacks, by ensuring that their content is not embedded into other sites. - [MDN Link](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Frame-Options)",
70+
},
71+
"X-Permitted-Cross-Domain-Policies": {
72+
description:
73+
"A cross-domain policy file is an XML document that grants a web client, such as Adobe Flash Player or Adobe Acrobat (though not necessarily limited to these), permission to handle data across domains. When clients request content hosted on a particular source domain and that content makes requests directed towards a domain other than its own, the remote domain needs to host a cross-domain policy file that grants access to the source domain, allowing the client to continue the transaction. Normally a meta-policy is declared in the master policy file, but for those who can't write to the root directory, they can also declare a meta-policy using the X-Permitted-Cross-Domain-Policies HTTP response header. - [OWASP Link](https://owasp.org/www-project-secure-headers/#x-permitted-cross-domain-policies)",
74+
},
75+
};
76+
77+
this.headerMap = {
78+
cacheControl: "Cache-Control",
79+
clearSiteData: "Clear-Site-Data",
80+
contentSecurityPolicy: "Content-Security-Policy",
81+
crossOriginEmbedderPolicy: "Cross-Origin-Embedder-Policy",
82+
crossOriginOpenerPolicy: "Cross-Origin-Opener-Policy",
83+
crossOriginResourcePolicy: "Cross-Origin-Resource-Policy",
84+
permissionsPolicy: "Permissions-Policy",
85+
pragma: "Pragma",
86+
referrerPolicy: "Referrer-Policy",
87+
strictTransportSecurity: "Strict-Transport-Security",
88+
xContentTypeOptions: "X-Content-Type-Options",
89+
xFrameOptions: "X-Frame-Options",
90+
xPermittedCrossDomainPolicies: "X-Permitted-Cross-Domain-Policies",
91+
};
92+
}
93+
94+
async getLatest() {
95+
const headerJSON = await new Promise((resolve, reject) => {
96+
const req = https
97+
.get(
98+
"https://owasp.org/www-project-secure-headers/ci/headers_add.json",
99+
(res) => {
100+
let data = [];
101+
102+
if (res.statusCode !== 200) {
103+
resolve(defaultOWASP);
61104
}
62-
}
63-
64-
this.headerMap = {
65-
cacheControl: 'Cache-Control',
66-
clearSiteData: 'Clear-Site-Data',
67-
contentSecurityPolicy: 'Content-Security-Policy',
68-
crossOriginEmbedderPolicy: 'Cross-Origin-Embedder-Policy',
69-
crossOriginOpenerPolicy: 'Cross-Origin-Opener-Policy',
70-
crossOriginResourcePolicy: 'Cross-Origin-Resource-Policy',
71-
permissionsPolicy: 'Permissions-Policy',
72-
pragma: 'Pragma',
73-
referrerPolicy: 'Referrer-Policy',
74-
strictTransportSecurity: 'Strict-Transport-Security',
75-
xContentTypeOptions: 'X-Content-Type-Options',
76-
xFrameOptions: 'X-Frame-Options',
77-
xPermittedCrossDomainPolicies: 'X-Permitted-Cross-Domain-Policies'
78-
}
79-
}
80-
81-
async getLatest() {
82-
const headerJSON = await new Promise((resolve, reject) => {
83-
const req = https.get('https://owasp.org/www-project-secure-headers/ci/headers_add.json', (res) => {
84-
let data = []
85-
86-
if (res.statusCode !== 200) {
87-
resolve(defaultOWASP)
88-
}
89-
90-
res.on('error', (err) => {
91-
resolve(defaultOWASP)
92-
})
93-
94-
res.on('data', (chunk) => {
95-
data.push(chunk)
96-
})
97-
98-
res.on('end', () => {
99-
resolve(JSON.parse(Buffer.concat(data).toString()))
100-
})
101-
})
102-
.on('error', (err) => {
103-
resolve(defaultOWASP)
104-
})
105-
106-
req.end()
107-
})
108105

109-
this.populateDefaults(headerJSON)
106+
res.on("error", (err) => {
107+
resolve(defaultOWASP);
108+
});
109+
110+
res.on("data", (chunk) => {
111+
data.push(chunk);
112+
});
113+
114+
res.on("end", () => {
115+
resolve(JSON.parse(Buffer.concat(data).toString()));
116+
});
117+
}
118+
)
119+
.on("error", (err) => {
120+
resolve(defaultOWASP);
121+
});
122+
123+
req.end();
124+
});
125+
126+
this.populateDefaults(headerJSON);
127+
}
128+
129+
/**
130+
* @funtion populateDefaults
131+
* @param {OWASPHeaders} headerJSON
132+
*/
133+
populateDefaults(headerJSON) {
134+
for (const header of headerJSON.headers) {
135+
const headerObj = {
136+
schema: {
137+
type: "string",
138+
default: header.value,
139+
example: header.value,
140+
},
141+
};
142+
143+
if (this.DEFAULT_OWASP_HEADERS?.[header.name]) {
144+
Object.assign(this.DEFAULT_OWASP_HEADERS[header.name], headerObj);
145+
} else {
146+
Object.assign(this.DEFAULT_OWASP_HEADERS, {
147+
[header.name]: headerObj,
148+
});
149+
}
110150
}
111-
112-
/**
113-
* @funtion populateDefaults
114-
* @param {OWASPHeaders} headerJSON
115-
*/
116-
populateDefaults(headerJSON) {
117-
for (const header of headerJSON.headers) {
118-
if (this.DEFAULT_OWASP_HEADERS?.[header.name]) {
119-
Object.assign(this.DEFAULT_OWASP_HEADERS[header.name], {schema: {type: 'string', default: header.value}})
120-
} else {
121-
Object.assign(this.DEFAULT_OWASP_HEADERS, {[header.name]: {schema: {type: 'string', default: header.value}}})
122-
}
123-
}
151+
}
152+
153+
getHeaders(headerList) {
154+
const obj = {};
155+
for (const headerName of Object.keys(headerList)) {
156+
const defaultHeader =
157+
this.DEFAULT_OWASP_HEADERS[this.headerMap[headerName]];
158+
Object.assign(obj, { [this.headerMap[headerName]]: defaultHeader });
159+
160+
if (typeof headerList[headerName] !== "boolean") {
161+
obj[this.headerMap[headerName]].schema.default =
162+
headerList[headerName].value;
163+
}
124164
}
125165

126-
getHeaders(headerList) {
127-
const obj = {}
128-
for (const headerName of Object.keys(headerList)) {
129-
const defaultHeader = this.DEFAULT_OWASP_HEADERS[this.headerMap[headerName]]
130-
Object.assign(obj, {[this.headerMap[headerName]]: defaultHeader})
131-
132-
if (typeof headerList[headerName] !== 'boolean') {
133-
obj[this.headerMap[headerName]].schema.default = headerList[headerName].value
134-
}
135-
}
136-
137-
return obj
138-
}
166+
return obj;
167+
}
139168
}
140169

141-
module.exports = new OWASP()
170+
module.exports = new OWASP();

0 commit comments

Comments
 (0)