From: Robert C. Maehl <rcmaehl@aol.com>
Date: Thu, 29 Jun 2023 03:10:13 +0000 (-0400)
Subject: Add Security.txt (#1408)
X-Git-Url: http://these/git/%7B%60%24%7BghostArchiveUrl%7D/static/readmes/%7BpictrsAvatarThumbnail%28user.avatar%29%7D?a=commitdiff_plain;h=9a04d0c58e62cc2421f64e7a0d9321d61e840c5c;p=lemmy-ui.git

Add Security.txt (#1408)

* Create security-handler.ts

https://securitytxt.org/

* Add SecurityHandler

* Update security-handler.ts

* Update index.tsx

* Ensure external domain.tld is used

---------

Co-authored-by: SleeplessOne1917 <abias1122@gmail.com>
---

diff --git a/src/server/handlers/security-handler.ts b/src/server/handlers/security-handler.ts
new file mode 100644
index 0000000..ceece13
--- /dev/null
+++ b/src/server/handlers/security-handler.ts
@@ -0,0 +1,11 @@
+import type { Response } from "express";
+
+export default async ({ res }: { res: Response }) => {
+  res.setHeader("content-type", "text/plain; charset=utf-8");
+
+  res.send(`Contact: mailto:security@lemmy.ml
+  Contact: mailto:admin@` + process.env.LEMMY_UI_LEMMY_EXTERNAL_HOST + `
+  Contact: mailto:security@` + process.env.LEMMY_UI_LEMMY_EXTERNAL_HOST + `
+  Expires: 2024-01-01T04:59:00.000Z
+  `);
+};
diff --git a/src/server/index.tsx b/src/server/index.tsx
index aed8bca..e896641 100644
--- a/src/server/index.tsx
+++ b/src/server/index.tsx
@@ -4,6 +4,7 @@ import path from "path";
 import process from "process";
 import CatchAllHandler from "./handlers/catch-all-handler";
 import ManifestHandler from "./handlers/manifest-handler";
+import SecurityHandler from "./handlers/security-handler";
 import RobotsHandler from "./handlers/robots-handler";
 import ServiceWorkerHandler from "./handlers/service-worker-handler";
 import ThemeHandler from "./handlers/theme-handler";
@@ -25,6 +26,7 @@ if (!process.env["LEMMY_UI_DISABLE_CSP"] && !process.env["LEMMY_UI_DEBUG"]) {
   server.use(setDefaultCsp);
 }
 
+server.get("/.well-known/security.txt", SecurityHandler);
 server.get("/robots.txt", RobotsHandler);
 server.get("/service-worker.js", ServiceWorkerHandler);
 server.get("/manifest.webmanifest", ManifestHandler);