From ba183ce6543f102ae635502a0da0ac7c923cc97a Mon Sep 17 00:00:00 2001
From: Literallie
Date: Wed, 18 Oct 2017 17:10:23 +0200
Subject: Add basic CSP support

---
 lib/config/default.js | 10 ++++++++++
 1 file changed, 10 insertions(+)

(limited to 'lib')

diff --git a/lib/config/default.js b/lib/config/default.js
index f4c45e3d..e207dfc6 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -13,6 +13,16 @@ module.exports = {
     includeSubdomains: true,
     preload: true
   },
+  csp: {
+    enable: true,
+    reportUri: '',
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+      fontSrc: ["'self'"]
+    }
+  },
   protocolusessl: false,
   usecdn: true,
   allowanonymous: true,
-- 
cgit v1.3.1


From 5d2d3ec875310de07fe79ae605dfbc0f1df585c5 Mon Sep 17 00:00:00 2001
From: Literallie
Date: Wed, 18 Oct 2017 17:45:57 +0200
Subject: CSP: Upgrade insecure requests if possible

Config option; default is to only upgrade if usessl
---
 app.js                | 5 +++++
 lib/config/default.js | 5 +++--
 2 files changed, 8 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/app.js b/app.js
index 54ec6cf7..8af029e7 100644
--- a/app.js
+++ b/app.js
@@ -126,6 +126,11 @@ if (config.csp.enable) {
       directives[propertyName] = directive;
     }
   }
+  if(config.csp.upgradeInsecureRequests === 'auto') {
+    directives.upgradeInsecureRequests = config.usessl === 'true'
+  } else {
+    directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true'
+  }
   app.use(helmet.contentSecurityPolicy({
     directives: directives
   }))
diff --git a/lib/config/default.js b/lib/config/default.js
index e207dfc6..217d11d0 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -20,8 +20,9 @@ module.exports = {
       defaultSrc: ["'self'"],
       scriptSrc: ["'self'"],
       styleSrc: ["'self'", "'unsafe-inline'"],
-      fontSrc: ["'self'"]
-    }
+      fontSrc: ["'self'"],
+    },
+    upgradeInsecureRequests: 'auto'
   },
   protocolusessl: false,
   usecdn: true,
-- 
cgit v1.3.1


From 080436aebb4c4681f85cc8bf5d8563832ff8dbdd Mon Sep 17 00:00:00 2001
From: Literallie
Date: Wed, 18 Oct 2017 17:48:53 +0200
Subject: CSP: Add nonce to slide view inline JS

---
 app.js                 | 7 +++++++
 lib/response.js        | 3 ++-
 package.json           | 1 +
 public/views/slide.ejs | 2 +-
 4 files changed, 11 insertions(+), 2 deletions(-)

(limited to 'lib')

diff --git a/app.js b/app.js
index 8af029e7..b78f94e1 100644
--- a/app.js
+++ b/app.js
@@ -12,6 +12,7 @@ var session = require('express-session')
 var SequelizeStore = require('connect-session-sequelize')(session.Store)
 var fs = require('fs')
 var path = require('path')
+var uuid = require('uuid')
 
 var morgan = require('morgan')
 var passportSocketIo = require('passport.socketio')
@@ -108,6 +109,11 @@ if (config.hsts.enable) {
   logger.info('https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security')
 }
 
+app.use((req, res, next) => {
+  res.locals.nonce = uuid.v4()
+  next()
+})
+
 // use Content-Security-Policy to limit XSS, dangerous plugins, etc.
 // https://helmetjs.github.io/docs/csp/
 if (config.csp.enable) {
@@ -126,6 +132,7 @@ if (config.csp.enable) {
       directives[propertyName] = directive;
     }
   }
+  directives.scriptSrc.push(function (req, res) { return "'nonce-" + res.locals.nonce + "'" })
   if(config.csp.upgradeInsecureRequests === 'auto') {
     directives.upgradeInsecureRequests = config.usessl === 'true'
   } else {
diff --git a/lib/response.js b/lib/response.js
index a22d1e70..287d53e0 100755
--- a/lib/response.js
+++ b/lib/response.js
@@ -584,7 +584,8 @@ function showPublishSlide (req, res, next) {
         lastchangeuserprofile: note.lastchangeuser ? models.User.getProfile(note.lastchangeuser) : null,
         robots: meta.robots || false, // default allow robots
         GA: meta.GA,
-        disqus: meta.disqus
+        disqus: meta.disqus,
+        cspNonce: res.locals.nonce
       }
       return renderPublishSlide(data, res)
     }).catch(function (err) {
diff --git a/package.json b/package.json
index 4c8dc562..35fe4f9c 100644
--- a/package.json
+++ b/package.json
@@ -114,6 +114,7 @@
     "tedious": "^1.14.0",
     "to-markdown": "^3.0.3",
     "toobusy-js": "^0.5.1",
+    "uuid": "^3.1.0",
     "uws": "~0.14.1",
     "validator": "^6.2.0",
     "velocity-animate": "^1.4.0",
diff --git a/public/views/slide.ejs b/public/views/slide.ejs
index 7ff5016e..c7dd9898 100644
--- a/public/views/slide.ejs
+++ b/public/views/slide.ejs
@@ -41,7 +41,7 @@
         <link rel="stylesheet" href="<%- url %>/css/slide.css">
 
         <!-- Printing and PDF exports -->
-        <script>
+        <script nonce="<%= cspNonce %>">
             var link = document.createElement( 'link' );
             link.rel = 'stylesheet';
             link.type = 'text/css';
-- 
cgit v1.3.1


From 0cbdc852cb29bfcadf1229899938c757b03f5ed6 Mon Sep 17 00:00:00 2001
From: Literallie
Date: Wed, 18 Oct 2017 22:44:16 +0200
Subject: CSP: Allow more content types

---
 lib/config/default.js | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

(limited to 'lib')

diff --git a/lib/config/default.js b/lib/config/default.js
index 217d11d0..0b6ca26a 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -18,9 +18,13 @@ module.exports = {
     reportUri: '',
     directives: {
       defaultSrc: ["'self'"],
-      scriptSrc: ["'self'"],
-      styleSrc: ["'self'", "'unsafe-inline'"],
-      fontSrc: ["'self'"],
+      scriptSrc: ["'self'", "'unsafe-eval'", "vimeo.com", "https://gist.github.com", "www.slideshare.net", "https://query.yahooapis.com", "https://*.disqus.com"],
+      imgSrc: ["*"],
+      styleSrc: ["'self'", "'unsafe-inline'", "https://assets-cdn.github.com"],
+      fontSrc: ["'self'", "https://public.slidesharecdn.com"],
+      objectSrc: ["*"],
+      childSrc: ["*"],
+      connectSrc: ["'self'", "https://links.services.disqus.com", "wss://realtime.services.disqus.com"]
     },
     upgradeInsecureRequests: 'auto'
   },
-- 
cgit v1.3.1


From 91101c856c3efac53e8a4db4cc537b77370aa7df Mon Sep 17 00:00:00 2001
From: Literallie
Date: Fri, 20 Oct 2017 12:31:16 +0200
Subject: Change CSP config format to be more intuitive

---
 README.md                 |  2 ++
 app.js                    | 40 +++++++++++++++++++++++++++++++++++-----
 config.json.example       |  7 +++++++
 lib/config/default.js     | 10 +---------
 lib/config/environment.js |  3 +++
 5 files changed, 48 insertions(+), 14 deletions(-)

(limited to 'lib')

diff --git a/README.md b/README.md
index 6e2e710d..d71eb1c5 100644
--- a/README.md
+++ b/README.md
@@ -158,6 +158,7 @@ Environment variables (will overwrite other server configs)
 | HMD_HSTS_INCLUDE_SUBDOMAINS | `true` | set to include subdomains in HSTS (default is `true`) |
 | HMD_HSTS_MAX_AGE | `31536000` | max duration in seconds to tell clients to keep HSTS status (default is a year) |
 | HMD_HSTS_PRELOAD | `true` | whether to allow preloading of the site's HSTS status (e.g. into browsers) |
+| HMD_CSP_ENABLE | `true` | whether to enable Content Security Policy (directives cannot be configured with environment variables) |
 
 Application settings `config.json`
 ---
@@ -171,6 +172,7 @@ Application settings `config.json`
 | alloworigin | `['localhost']` | domain name whitelist |
 | usessl | `true` or `false` | set to use ssl server (if true will auto turn on `protocolusessl`) |
 | hsts | `{"enable": "true", "maxAgeSeconds": "31536000", "includeSubdomains": "true", "preload": "true"}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) |
+| csp | `{"enable": "true", "directives": {"scriptSrc": "trustwodthy-scripts.example.com"}, "upgradeInsecureRequests": "auto", "addDefaults": "true"}` | Configures [Content Security Policy](https://helmetjs.github.io/docs/csp/). Directives are directly passed to Helmet, so [their format](https://helmetjs.github.io/docs/csp/) applies. Further, some defaults are added so  that the application doesn't break. To disable adding these defaults, set `addDefaults` to `false`. If `usecdn` is on, default CDN locations are allowed too. By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `usessl` is on. To change this behaviour, set `upgradeInsecureRequests` to either `true` or `false`. |
 | protocolusessl | `true` or `false` | set to use ssl protocol for resources path (only applied when domain is set) |
 | urladdport | `true` or `false` | set to add port on callback url (port 80 or 443 won't applied) (only applied when domain is set) |
 | usecdn | `true` or `false` | set to use CDN resources or not (default is `true`) |
diff --git a/app.js b/app.js
index 15c9e61e..01ecc84c 100644
--- a/app.js
+++ b/app.js
@@ -125,7 +125,28 @@ function getCspWebSocketUrl (req, res) {
   return (req.protocol === 'http' ? 'ws:' : 'wss:') + config.serverurl.replace(/https?:/, "")
 }
 
+function mergeWithDefaults(configured, defaultDirective, cdnDirective) {
+  var directive = [].concat(configured)
+  if (config.csp.addDefaults && defaultDirective) {
+    directive = directive.concat(defaultDirective)
+  }
+  if (config.usecdn && cdnDirective) {
+    directive = directive.concat(cdnDirective)
+  }
+  return directive
+}
+
 if (config.csp.enable) {
+  var defaultDirectives = {
+    defaultSrc: ['\'self\''],
+    scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', 'https://*.disqus.com', '\'unsafe-eval\''], // TODO: Remove unsafe-eval - webpack script-loader issues
+    imgSrc: ['*'],
+    styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views
+    fontSrc: ['\'self\'', 'https://public.slidesharecdn.com'],
+    objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/
+    childSrc: ['*'],
+    connectSrc: ['\'self\'', 'https://links.services.disqus.com', 'wss://realtime.services.disqus.com']
+  };
   var cdnDirectives = {
     scriptSrc: ['https://cdnjs.cloudflare.com', 'https://cdn.mathjax.org'],
     styleSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.googleapis.com'],
@@ -134,11 +155,20 @@ if (config.csp.enable) {
   var directives = {}
   for (var propertyName in config.csp.directives) {
     if (config.csp.directives.hasOwnProperty(propertyName)) {
-      var directive = [].concat(config.csp.directives[propertyName])
-      if (config.usecdn && !!cdnDirectives[propertyName]) {
-        directive = directive.concat(cdnDirectives[propertyName])
-      }
-      directives[propertyName] = directive
+      directives[propertyName] = mergeWithDefaults(
+        config.csp.directives[propertyName],
+        defaultDirectives[propertyName],
+        cdnDirectives[propertyName]
+      )
+    }
+  }
+  for (var propertyName in defaultDirectives) {
+    if (!directives[propertyName]) {
+      directives[propertyName] = mergeWithDefaults(
+        [],
+        defaultDirectives[propertyName],
+        cdnDirectives[propertyName]
+      )
     }
   }
   directives.scriptSrc.push(getCspNonce)
diff --git a/config.json.example b/config.json.example
index e2d774c7..7e4394b0 100644
--- a/config.json.example
+++ b/config.json.example
@@ -22,6 +22,13 @@
             "includeSubdomains": "true",
             "preload": "true"
         },
+        csp: {
+	    "enable": "true",
+            "directives": {
+            },
+            "upgradeInsecureRequests": "auto"
+            "addDefaults": "true"
+        },
         "db": {
             "username": "",
             "password": "",
diff --git a/lib/config/default.js b/lib/config/default.js
index 0b6ca26a..cfde9ae9 100644
--- a/lib/config/default.js
+++ b/lib/config/default.js
@@ -15,17 +15,9 @@ module.exports = {
   },
   csp: {
     enable: true,
-    reportUri: '',
     directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'", "'unsafe-eval'", "vimeo.com", "https://gist.github.com", "www.slideshare.net", "https://query.yahooapis.com", "https://*.disqus.com"],
-      imgSrc: ["*"],
-      styleSrc: ["'self'", "'unsafe-inline'", "https://assets-cdn.github.com"],
-      fontSrc: ["'self'", "https://public.slidesharecdn.com"],
-      objectSrc: ["*"],
-      childSrc: ["*"],
-      connectSrc: ["'self'", "https://links.services.disqus.com", "wss://realtime.services.disqus.com"]
     },
+    addDefaults: true,
     upgradeInsecureRequests: 'auto'
   },
   protocolusessl: false,
diff --git a/lib/config/environment.js b/lib/config/environment.js
index 40b7e09f..fa9698f6 100644
--- a/lib/config/environment.js
+++ b/lib/config/environment.js
@@ -14,6 +14,9 @@ module.exports = {
     includeSubdomains: toBooleanConfig(process.env.HMD_HSTS_INCLUDE_SUBDOMAINS),
     preload: toBooleanConfig(process.env.HMD_HSTS_PRELOAD)
   },
+  csp: {
+    enable: toBooleanConfig(process.env.HMD_CSP_ENABLE)
+  },
   protocolusessl: toBooleanConfig(process.env.HMD_PROTOCOL_USESSL),
   alloworigin: process.env.HMD_ALLOW_ORIGIN ? process.env.HMD_ALLOW_ORIGIN.split(',') : undefined,
   usecdn: toBooleanConfig(process.env.HMD_USECDN),
-- 
cgit v1.3.1


From 04f5e3a3414abbb76841df8375598fb690323f11 Mon Sep 17 00:00:00 2001
From: Literallie
Date: Sun, 22 Oct 2017 01:22:48 +0200
Subject: Move CSP logic to new file, Fix boolean config examples

Not sure why I was quoting these in the first place
---
 README.md           |  4 +--
 app.js              | 77 +++------------------------------------------------
 config.json.example | 10 +++----
 lib/csp.js          | 80 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 public/js/index.js  |  1 -
 5 files changed, 91 insertions(+), 81 deletions(-)
 create mode 100644 lib/csp.js

(limited to 'lib')

diff --git a/README.md b/README.md
index d71eb1c5..2633b3b6 100644
--- a/README.md
+++ b/README.md
@@ -171,8 +171,8 @@ Application settings `config.json`
 | port | `80` | web app port |
 | alloworigin | `['localhost']` | domain name whitelist |
 | usessl | `true` or `false` | set to use ssl server (if true will auto turn on `protocolusessl`) |
-| hsts | `{"enable": "true", "maxAgeSeconds": "31536000", "includeSubdomains": "true", "preload": "true"}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) |
-| csp | `{"enable": "true", "directives": {"scriptSrc": "trustwodthy-scripts.example.com"}, "upgradeInsecureRequests": "auto", "addDefaults": "true"}` | Configures [Content Security Policy](https://helmetjs.github.io/docs/csp/). Directives are directly passed to Helmet, so [their format](https://helmetjs.github.io/docs/csp/) applies. Further, some defaults are added so  that the application doesn't break. To disable adding these defaults, set `addDefaults` to `false`. If `usecdn` is on, default CDN locations are allowed too. By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `usessl` is on. To change this behaviour, set `upgradeInsecureRequests` to either `true` or `false`. |
+| hsts | `{"enable": true, "maxAgeSeconds": 31536000, "includeSubdomains": true, "preload": true}` | [HSTS](https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security) options to use with HTTPS (default is the example value, max age is a year) |
+| csp | `{"enable": true, "directives": {"scriptSrc": "trustworthy-scripts.example.com"}, "upgradeInsecureRequests": "auto", "addDefaults": true}` | Configures [Content Security Policy](https://helmetjs.github.io/docs/csp/). Directives are passed to Helmet - see [their documentation](https://helmetjs.github.io/docs/csp/) for more information on the format. Some defaults are added to the configured values so that the application doesn't break. To disable this behaviour, set `addDefaults` to `false`. Further, if `usecdn` is on, some CDN locations are allowed too. By default (`auto`), insecure (HTTP) requests are upgraded to HTTPS via CSP if `usessl` is on. To change this behaviour, set `upgradeInsecureRequests` to either `true` or `false`. |
 | protocolusessl | `true` or `false` | set to use ssl protocol for resources path (only applied when domain is set) |
 | urladdport | `true` or `false` | set to add port on callback url (port 80 or 443 won't applied) (only applied when domain is set) |
 | usecdn | `true` or `false` | set to use CDN resources or not (default is `true`) |
diff --git a/app.js b/app.js
index cdabc7d7..055b8f4c 100644
--- a/app.js
+++ b/app.js
@@ -12,7 +12,6 @@ var session = require('express-session')
 var SequelizeStore = require('connect-session-sequelize')(session.Store)
 var fs = require('fs')
 var path = require('path')
-var uuid = require('uuid')
 
 var morgan = require('morgan')
 var passportSocketIo = require('passport.socketio')
@@ -25,6 +24,7 @@ var config = require('./lib/config')
 var logger = require('./lib/logger')
 var response = require('./lib/response')
 var models = require('./lib/models')
+var csp = require('./lib/csp')
 
 // generate front-end constants by template
 var constpath = path.join(__dirname, './public/js/lib/common/constant.ejs')
@@ -109,83 +109,14 @@ if (config.hsts.enable) {
   logger.info('https://en.wikipedia.org/wiki/HTTP_Strict_Transport_Security')
 }
 
-app.use((req, res, next) => {
-  res.locals.nonce = uuid.v4()
-  next()
-})
+// Generate a random nonce per request, for CSP with inline scripts
+app.use(csp.addNonceToLocals)
 
 // use Content-Security-Policy to limit XSS, dangerous plugins, etc.
 // https://helmetjs.github.io/docs/csp/
-function getCspNonce (req, res) {
-  return "'nonce-" + res.locals.nonce + "'"
-}
-
-function getCspWebSocketUrl (req, res) {
-  // wss: is included in 'self', but 'ws:' is not
-  return (req.protocol === 'http' ? 'ws:' : 'wss:') + config.serverurl.replace(/https?:/, "")
-}
-
-function mergeWithDefaults(configured, defaultDirective, cdnDirective) {
-  var directive = [].concat(configured)
-  if (config.csp.addDefaults && defaultDirective) {
-    directive = directive.concat(defaultDirective)
-  }
-  if (config.usecdn && cdnDirective) {
-    directive = directive.concat(cdnDirective)
-  }
-  return directive
-}
-
 if (config.csp.enable) {
-  var defaultDirectives = {
-    defaultSrc: ['\'self\''],
-    scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', 'https://*.disqus.com', '\'unsafe-eval\''], // TODO: Remove unsafe-eval - webpack script-loader issues
-    imgSrc: ['*'],
-    styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views
-    fontSrc: ['\'self\'', 'https://public.slidesharecdn.com'],
-    objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/
-    childSrc: ['*'],
-    connectSrc: ['*']
-  };
-  var cdnDirectives = {
-    scriptSrc: ['https://cdnjs.cloudflare.com', 'https://cdn.mathjax.org'],
-    styleSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.googleapis.com'],
-    fontSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.gstatic.com']
-  }
-  var directives = {}
-  for (var propertyName in config.csp.directives) {
-    if (config.csp.directives.hasOwnProperty(propertyName)) {
-      directives[propertyName] = mergeWithDefaults(
-        config.csp.directives[propertyName],
-        defaultDirectives[propertyName],
-        cdnDirectives[propertyName]
-      )
-    }
-  }
-  for (var propertyName in defaultDirectives) {
-    if (!directives[propertyName]) {
-      directives[propertyName] = mergeWithDefaults(
-        [],
-        defaultDirectives[propertyName],
-        cdnDirectives[propertyName]
-      )
-    }
-  }
-  if (directives.scriptSrc.indexOf('\'unsafe-inline\'') === -1) {
-    directives.scriptSrc.push(getCspNonce)
-    // TODO: This is the SHA-256 hash of the inline script in
-    // build/reveal.js/plugins/notes/notes.html . Any cleaner
-    // solution appreciated.
-    directives.scriptSrc.push('\'sha256-EtvSSxRwce5cLeFBZbvZvDrTiRoyoXbWWwvEVciM5Ag=\'')
-  }
-  directives.connectSrc.push(getCspWebSocketUrl)
-  if (config.csp.upgradeInsecureRequests === 'auto') {
-    directives.upgradeInsecureRequests = config.usessl === 'true'
-  } else {
-    directives.upgradeInsecureRequests = config.csp.upgradeInsecureRequests === 'true'
-  }
   app.use(helmet.contentSecurityPolicy({
-    directives: directives
+    directives: csp.computeDirectives()
   }))
 } else {
   logger.info('Content-Security-Policy is disabled. This may be a security risk.')
diff --git a/config.json.example b/config.json.example
index 7e4394b0..98658770 100644
--- a/config.json.example
+++ b/config.json.example
@@ -17,17 +17,17 @@
     "production": {
         "domain": "localhost",
         "hsts": {
-            "enable": "true",
+            "enable": true,
             "maxAgeSeconds": "31536000",
-            "includeSubdomains": "true",
-            "preload": "true"
+            "includeSubdomains": true,
+            "preload": true
         },
         csp: {
-	    "enable": "true",
+            "enable": true,
             "directives": {
             },
             "upgradeInsecureRequests": "auto"
-            "addDefaults": "true"
+            "addDefaults": true
         },
         "db": {
             "username": "",
diff --git a/lib/csp.js b/lib/csp.js
new file mode 100644
index 00000000..509bc530
--- /dev/null
+++ b/lib/csp.js
@@ -0,0 +1,80 @@
+var config = require('./config')
+var uuid = require('uuid')
+
+var CspStrategy = {}
+
+var defaultDirectives = {
+  defaultSrc: ['\'self\''],
+  scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', 'https://*.disqus.com', '\'unsafe-eval\''],
+  // ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/hackmd/issues/594
+  imgSrc: ['*'],
+  styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views
+  fontSrc: ['\'self\'', 'https://public.slidesharecdn.com'],
+  objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/
+  childSrc: ['*'],
+  connectSrc: ['*']
+}
+
+var cdnDirectives = {
+  scriptSrc: ['https://cdnjs.cloudflare.com', 'https://cdn.mathjax.org'],
+  styleSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.googleapis.com'],
+  fontSrc: ['https://cdnjs.cloudflare.com', 'https://fonts.gstatic.com']
+}
+
+CspStrategy.computeDirectives = function () {
+  var directives = {}
+  mergeDirectives(directives, config.csp.directives)
+  mergeDirectivesIf(config.csp.addDefaults, directives, defaultDirectives)
+  mergeDirectivesIf(config.usecdn, directives, cdnDirectives)
+  if (!areAllInlineScriptsAllowed(directives)) {
+    addInlineScriptExceptions(directives)
+  }
+  addUpgradeUnsafeRequestsOptionTo(directives)
+  return directives
+}
+
+function mergeDirectives (existingDirectives, newDirectives) {
+  for (var propertyName in newDirectives) {
+    var newDirective = newDirectives[propertyName]
+    if (newDirective) {
+      var existingDirective = existingDirectives[propertyName] || []
+      existingDirectives[propertyName] = existingDirective.concat(newDirective)
+    }
+  }
+}
+
+function mergeDirectivesIf (condition, existingDirectives, newDirectives) {
+  if (condition) {
+    mergeDirectives(existingDirectives, newDirectives)
+  }
+}
+
+function areAllInlineScriptsAllowed (directives) {
+  return directives.scriptSrc.indexOf('\'unsafe-inline\'') !== -1
+}
+
+function addInlineScriptExceptions (directives) {
+  directives.scriptSrc.push(getCspNonce)
+  // TODO: This is the SHA-256 hash of the inline script in build/reveal.js/plugins/notes/notes.html
+  // Any more clean solution appreciated.
+  directives.scriptSrc.push('\'sha256-EtvSSxRwce5cLeFBZbvZvDrTiRoyoXbWWwvEVciM5Ag=\'')
+}
+
+function getCspNonce (req, res) {
+  return "'nonce-" + res.locals.nonce + "'"
+}
+
+function addUpgradeUnsafeRequestsOptionTo (directives) {
+  if (config.csp.upgradeInsecureRequests === 'auto' && config.usessl) {
+    directives.upgradeInsecureRequests = true
+  } else if (config.csp.upgradeInsecureRequests === true) {
+    directives.upgradeInsecureRequests = true
+  }
+}
+
+CspStrategy.addNonceToLocals = function (req, res, next) {
+  res.locals.nonce = uuid.v4()
+  next()
+}
+
+module.exports = CspStrategy
diff --git a/public/js/index.js b/public/js/index.js
index 25bd1c36..56522e9c 100644
--- a/public/js/index.js
+++ b/public/js/index.js
@@ -3,7 +3,6 @@
    modeType, Idle, serverurl, key, gapi, Dropbox, FilePicker
    ot, MediaUploader, hex2rgb, num_loaded, Visibility */
 
-
 require('../vendor/showup/showup')
 
 require('../css/index.css')
-- 
cgit v1.3.1