update-owasp.mjs

Functions

Imports

It imports no other module of this repo. No module of this repo imports it.

Source

1#!/usr/bin/env node
2/**
3 * Refreshes the package's copy of the OWASP Secure Headers Project data from the project itself, so no default is
4 * typed from memory:
5 *
6 *   node update-owasp.mjs
7 *
8 * It reads, from the project's repository (https://github.com/OWASP/www-project-secure-headers, the source of
9 * https://owasp.org/www-project-secure-headers/):
10 *   - ci/headers_add.json     the headers OSHP recommends a response carry, with its `last_update_utc`
11 *   - ci/headers_remove.json  the headers OSHP recommends a response not carry
12 *   - subprojects/validator/tests_suite.yml  OSHP's own header test suite (a venom suite), kept verbatim
13 *
14 * and writes owasp-headers.mjs and oshp-tests-suite.yml beside this file, and the "Source" block of README.md with
15 * the page, the files and the date they were read. Exits non-zero when a file cannot be read or has an unexpected
16 * shape, so a failed refresh never leaves a half-written set.
17 */
18
19import { readFile, writeFile } from "node:fs/promises";
20import { fileURLToPath } from "node:url";
21
22const RAW = "https://raw.githubusercontent.com/OWASP/www-project-secure-headers/master";
23const PAGE = "https://owasp.org/www-project-secure-headers/";
24const REPO = "https://github.com/OWASP/www-project-secure-headers";
25const here = (/** @type {string} */ name) => fileURLToPath(new URL(name, import.meta.url));
26
27/** @param {string} path */
28async function read(path) {
29  const res = await fetch(`${RAW}/${path}`, { headers: { "user-agent": "security-headers update" } });
30  if (!res.ok) throw new Error(`${RAW}/${path} answered ${res.status}`);
31  return res.text();
32}
33
34const [addText, removeText, suite] = await Promise.all([
35  read("ci/headers_add.json"),
36  read("ci/headers_remove.json"),
37  read("subprojects/validator/tests_suite.yml"),
38]);
39const add = JSON.parse(addText);
40const remove = JSON.parse(removeText);
41if (!Array.isArray(add.headers) || add.headers.length === 0 || add.headers.some((/** @type {any} */ h) => typeof h?.name !== "string" || typeof h?.value !== "string")) {
42  throw new Error("headers_add.json is not a list of { name, value }");
43}
44if (!Array.isArray(remove.headers) || remove.headers.some((/** @type {any} */ h) => typeof h !== "string")) throw new Error("headers_remove.json is not a list of names");
45if (!suite.includes("testcases:")) throw new Error("tests_suite.yml has no testcases");
46
47const fetchedAt = new Date().toISOString().slice(0, 10);
48const headers = Object.fromEntries(add.headers.map((/** @type {{ name: string, value: string }} */ h) => [h.name, h.value]));
49
50const module = `// GENERATED by update-owasp.mjs from the OWASP Secure Headers Project. Do not edit: run the script.
51// Page: ${PAGE}
52// Data: ${REPO}/tree/master/ci (headers_add.json, headers_remove.json), read ${fetchedAt}.
53
54/** Where these values were read, and when. */
55export const OWASP_SOURCE = Object.freeze({
56  page: ${JSON.stringify(PAGE)},
57  data: ${JSON.stringify(`${REPO}/tree/master/ci`)},
58  readOn: ${JSON.stringify(fetchedAt)},
59  lastUpdateUtc: ${JSON.stringify(add.last_update_utc ?? null)},
60});
61
62/** The headers OSHP recommends a response carry, as OSHP writes them. */
63export const OWASP_RECOMMENDED = Object.freeze(${JSON.stringify(headers, null, 2)});
64
65/** The headers OSHP recommends a response not carry (they name the software that served it). */
66export const OWASP_REMOVE = Object.freeze(${JSON.stringify(remove.headers, null, 2)});
67`;
68await writeFile(here("owasp-headers.mjs"), module, "utf8");
69await writeFile(here("oshp-tests-suite.yml"), suite, "utf8");
70
71const block = [
72  "<!-- owasp:begin -->",
73  `The defaults are read from the OWASP Secure Headers Project, not typed here: page ${PAGE}, data ${REPO}/tree/master/ci`,
74  `(\`headers_add.json\`, \`headers_remove.json\`, last updated by OWASP ${add.last_update_utc ?? "(not stated)"} UTC), and its header test suite`,
75  `\`subprojects/validator/tests_suite.yml\`, all read on **${fetchedAt}**. Refresh with \`node update-owasp.mjs\`.`,
76  "<!-- owasp:end -->",
77].join("\n");
78const readmePath = here("README.md");
79const readme = await readFile(readmePath, "utf8");
80if (!readme.includes("<!-- owasp:begin -->")) throw new Error("README.md has no owasp:begin marker");
81await writeFile(readmePath, readme.replace(/<!-- owasp:begin -->[\s\S]*?<!-- owasp:end -->/, block), "utf8");
82console.log(`read ${Object.keys(headers).length} recommended headers, ${remove.headers.length} to remove, and the suite, on ${fetchedAt}`);