Skip to content

Scope CoolProp CSP exception to Mollier pages #6

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iguchi-lab merged 1 commit into from
Aug 17, 2026
Merged

Scope CoolProp CSP exception to Mollier pages #6

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
35 changes: 34 additions & 1 deletion template-deploy.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -104,7 +104,32 @@ Resources:
Name: !Sub '${AWS::StackName}-security-headers'
SecurityHeadersConfig:
ContentSecurityPolicy:
ContentSecurityPolicy: "default-src 'self'; style-src 'self'; script-src 'self' 'wasm-unsafe-eval'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
ContentSecurityPolicy: "default-src 'self'; style-src 'self'; script-src 'self'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Override: true
ContentTypeOptions:
Override: true
FrameOptions:
FrameOption: DENY
Override: true
ReferrerPolicy:
ReferrerPolicy: strict-origin-when-cross-origin
Override: true
StrictTransportSecurity:
AccessControlMaxAgeSec: 63072000
IncludeSubdomains: true
Preload: true
Override: true

MollierSecurityHeadersPolicy:
Type: AWS::CloudFront::ResponseHeadersPolicy
Properties:
ResponseHeadersPolicyConfig:
Name: !Sub '${AWS::StackName}-mollier-security-headers'
SecurityHeadersConfig:
ContentSecurityPolicy:
# CoolProp's Emscripten browser bundle uses both WebAssembly
# compilation and JavaScript's Function constructor.
ContentSecurityPolicy: "default-src 'self'; style-src 'self'; script-src 'self' 'unsafe-eval' 'wasm-unsafe-eval'; img-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'none'"
Override: true
ContentTypeOptions:
Override: true
Expand Down Expand Up @@ -146,6 +171,14 @@ Resources:
CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
ResponseHeadersPolicyId: !Ref SecurityHeadersPolicy
CacheBehaviors:
- PathPattern: /mollier/*
TargetOriginId: site
ViewerProtocolPolicy: redirect-to-https
AllowedMethods: [GET, HEAD, OPTIONS]
CachedMethods: [GET, HEAD, OPTIONS]
Compress: true
CachePolicyId: 658327ea-f89d-4fab-a63d-7e88639e58f6
ResponseHeadersPolicyId: !Ref MollierSecurityHeadersPolicy
- PathPattern: /api/*
TargetOriginId: api
ViewerProtocolPolicy: https-only
Expand Down
17 changes: 17 additions & 0 deletions tests_verified/test_security_headers.py
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,17 @@
from pathlib import Path


TEMPLATE = (Path(__file__).parents[1] / "template-deploy.yaml").read_text(encoding="utf-8")


def test_unsafe_eval_is_scoped_to_mollier_policy():
assert TEMPLATE.count("'unsafe-eval'") == 1
assert "MollierSecurityHeadersPolicy:" in TEMPLATE
assert "PathPattern: /mollier/*" in TEMPLATE
assert "ResponseHeadersPolicyId: !Ref MollierSecurityHeadersPolicy" in TEMPLATE


def test_default_policy_does_not_allow_dynamic_code_execution():
default_policy = TEMPLATE.split("MollierSecurityHeadersPolicy:", maxsplit=1)[0]
assert "'unsafe-eval'" not in default_policy
assert "'wasm-unsafe-eval'" not in default_policy
Loading