1259

pending completion

Build # 1259

Build Type

push

travis-ci

Committed by

web-flow

Commit Message

Merge pull request #375 from mozilla/disable-fxa-360

fix #360: FXA_ENABLED flag and default to false

Run Details

39 of 132 branches covered (29.55%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

261 of 524 relevant lines covered (49.81%)

5.62 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/server.js

"use strict";

const AppConstants = require("./app-constants");

const express = require("express");
const exphbs = require("express-handlebars");
const helmet = require("helmet");
const sessions = require("client-sessions");
const url = require("url");

const EmailUtils = require("./email-utils");
const HBSHelpers = require("./hbs-helpers");
const HIBP = require("./hibp");
const {logErrors, clientErrorHandler, errorHandler} = require("./middleware");

const HibpRoutes = require("./routes/hibp");
const HomeRoutes = require("./routes/home");
const ScanRoutes = require("./routes/scan");
const SesRoutes = require("./routes/ses");
const OAuthRoutes = require("./routes/oauth");
const UserRoutes = require("./routes/user");


const app = express();

// Redirect non-dev environments to HTTPS
app.enable("trust proxy");

if (app.get("env") !== "dev") {
  app.use( (req, res, next) => {
    if (req.secure) {
      next();
    } else {
      res.redirect("https://" + req.headers.host + req.url);
    }
  });
}

(async () => {
  try {
    await HIBP.loadBreachesIntoApp(app);
  } catch (error) {
    console.error(error);
  }
})();

// Use helmet to set security headers
app.use(helmet());
app.use(helmet.contentSecurityPolicy({
  directives: {
    baseUri: ["'none'"],
    defaultSrc: ["'none'"],
    connectSrc: [
      "'self'",
      "https://code.cdn.mozilla.net/fonts/",
      "https://www.google-analytics.com",
    ],
    fontSrc: ["'self'", "https://code.cdn.mozilla.net/fonts/"],
    frameAncestors: ["'none'"],
    imgSrc: ["'self'", "https://www.google-analytics.com"],
    scriptSrc: ["'self'", "https://www.google-analytics.com/analytics.js"],
    styleSrc: ["'self'", "https://code.cdn.mozilla.net/fonts/"],
    reportUri: "/__cspreport__",
  },
}));
app.use(helmet.referrerPolicy({ policy: "strict-origin-when-cross-origin" }));
app.use(express.static("public"));

app.engine("hbs", exphbs({
  extname: ".hbs",
  layoutsDir: __dirname + "/views/layouts",
  defaultLayout: "default",
  partialsDir: __dirname + "/views/partials",
  helpers: HBSHelpers,
}));
app.set("view engine", "hbs");

const cookie = {httpOnly: true, sameSite: "lax"};

if (app.get("env") === "dev") {
  app.set("trust proxy", false);
} else {
  app.set("trust proxy", true);
}

app.locals.FXA_ENABLED = AppConstants.FXA_ENABLED;
app.locals.SERVER_URL = AppConstants.SERVER_URL;
app.locals.UTM_SOURCE = url.parse(AppConstants.SERVER_URL).hostname;

app.use(sessions({
  cookieName: "session",
  secret: AppConstants.COOKIE_SECRET,
  duration: 15 * 60 * 1000, // 15 minutes
  activeDuration: 5 * 60 * 1000, // 5 minutes
  cookie: cookie,
}));

if (!AppConstants.DISABLE_DOCKERFLOW) {
  const DockerflowRoutes = require("./routes/dockerflow");
  app.use("/", DockerflowRoutes);
}
app.use("/hibp", HibpRoutes);
if (AppConstants.FXA_ENABLED) {
  app.use("/oauth", OAuthRoutes);
}
app.use("/scan", ScanRoutes);
app.use("/ses", SesRoutes);
app.use("/user", UserRoutes);
app.use("/", HomeRoutes);

app.use(logErrors);
app.use(clientErrorHandler);
app.use(errorHandler);

EmailUtils.init().then(() => {
  const listener = app.listen(AppConstants.PORT, () => {
    console.info(`Listening on ${listener.address().port}`);
  });
}).catch(error => {
  console.error(error);
});

1	"use strict";
2
3	const AppConstants = require("./app-constants");	×
4
5	const express = require("express");	×
6	const exphbs = require("express-handlebars");	×
7	const helmet = require("helmet");	×
8	const sessions = require("client-sessions");	×
9	const url = require("url");	×
10
11	const EmailUtils = require("./email-utils");	×
12	const HBSHelpers = require("./hbs-helpers");	×
13	const HIBP = require("./hibp");	×
14	const {logErrors, clientErrorHandler, errorHandler} = require("./middleware");	×
15
16	const HibpRoutes = require("./routes/hibp");	×
17	const HomeRoutes = require("./routes/home");	×
18	const ScanRoutes = require("./routes/scan");	×
19	const SesRoutes = require("./routes/ses");	×
20	const OAuthRoutes = require("./routes/oauth");	×
21	const UserRoutes = require("./routes/user");	×
22
23
24	const app = express();	×
25
26	// Redirect non-dev environments to HTTPS
27	app.enable("trust proxy");	×
28
29	if (app.get("env") !== "dev") {	×
30	app.use( (req, res, next) => {	×
31	if (req.secure) {	×
32	next();	×
33	} else {
34	res.redirect("https://" + req.headers.host + req.url);	×
35	}
36	});
37	}
38
39	(async () => {	×
40	try {	×
41	await HIBP.loadBreachesIntoApp(app);	×
42	} catch (error) {
43	console.error(error);	×
44	}
45	})();
46
47	// Use helmet to set security headers
48	app.use(helmet());	×
49	app.use(helmet.contentSecurityPolicy({	×
50	directives: {
51	baseUri: ["'none'"],
52	defaultSrc: ["'none'"],
53	connectSrc: [
54	"'self'",
55	"https://code.cdn.mozilla.net/fonts/",
56	"https://www.google-analytics.com",
57	],
58	fontSrc: ["'self'", "https://code.cdn.mozilla.net/fonts/"],
59	frameAncestors: ["'none'"],
60	imgSrc: ["'self'", "https://www.google-analytics.com"],
61	scriptSrc: ["'self'", "https://www.google-analytics.com/analytics.js"],
62	styleSrc: ["'self'", "https://code.cdn.mozilla.net/fonts/"],
63	reportUri: "/__cspreport__",
64	},
65	}));
66	app.use(helmet.referrerPolicy({ policy: "strict-origin-when-cross-origin" }));	×
67	app.use(express.static("public"));	×
68
69	app.engine("hbs", exphbs({	×
70	extname: ".hbs",
71	layoutsDir: __dirname + "/views/layouts",
72	defaultLayout: "default",
73	partialsDir: __dirname + "/views/partials",
74	helpers: HBSHelpers,
75	}));
76	app.set("view engine", "hbs");	×
77
78	const cookie = {httpOnly: true, sameSite: "lax"};	×
79
80	if (app.get("env") === "dev") {	×
81	app.set("trust proxy", false);	×
82	} else {
83	app.set("trust proxy", true);	×
84	}
85
86	app.locals.FXA_ENABLED = AppConstants.FXA_ENABLED;	×
87	app.locals.SERVER_URL = AppConstants.SERVER_URL;	×
88	app.locals.UTM_SOURCE = url.parse(AppConstants.SERVER_URL).hostname;	×
89
90	app.use(sessions({	×
91	cookieName: "session",
92	secret: AppConstants.COOKIE_SECRET,
93	duration: 15 * 60 * 1000, // 15 minutes
94	activeDuration: 5 * 60 * 1000, // 5 minutes
95	cookie: cookie,
96	}));
97
98	if (!AppConstants.DISABLE_DOCKERFLOW) {	×
99	const DockerflowRoutes = require("./routes/dockerflow");	×
100	app.use("/", DockerflowRoutes);	×
101	}
102	app.use("/hibp", HibpRoutes);	×
103	if (AppConstants.FXA_ENABLED) {	×
104	app.use("/oauth", OAuthRoutes);	×
105	}
106	app.use("/scan", ScanRoutes);	×
107	app.use("/ses", SesRoutes);	×
108	app.use("/user", UserRoutes);	×
109	app.use("/", HomeRoutes);	×
110
111	app.use(logErrors);	×
112	app.use(clientErrorHandler);	×
113	app.use(errorHandler);	×
114
115	EmailUtils.init().then(() => {	×
116	const listener = app.listen(AppConstants.PORT, () => {	×
117	console.info(`Listening on ${listener.address().port}`);	×
118	});
119	}).catch(error => {
120	console.error(error);	×
121	});

mozilla / blurts-server / 1259

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous