From 3b44c09bc4b0bfe4c9b7933142fd0f5c660cfeaf Mon Sep 17 00:00:00 2001
From: ansuz <ansuz@transitiontech.ca>
Date: Thu, 1 Jul 2021 16:42:09 +0530
Subject: [PATCH] check COOP headers for multiple endpoints

and improve some error reporting in the checkup RPC
---
 docs/example.nginx.conf     |  2 +-
 server.js                   |  2 +-
 www/checkup/main.js         | 30 ++++++++++++++++++++++++++++++
 www/checkup/sandbox/main.js | 12 +++++++++---
 4 files changed, 41 insertions(+), 5 deletions(-)

diff --git a/docs/example.nginx.conf b/docs/example.nginx.conf
index 29317ee27..8bc47d9f8 100644
--- a/docs/example.nginx.conf
+++ b/docs/example.nginx.conf
@@ -64,7 +64,7 @@ server {
     add_header Permissions-Policy interest-cohort=();
 
     set $coop '';
-    if ($uri ~ ^\/(sheet|presentation|doc)\/.*$) { set $coop 'same-origin'; }
+    if ($uri ~ ^\/(sheet|presentation|doc|convert)\/.*$) { set $coop 'same-origin'; }
 
     # Enable SharedArrayBuffer in Firefox (for .xlsx export)
     add_header Cross-Origin-Resource-Policy cross-origin;
diff --git a/server.js b/server.js
index 848167a98..3cea171c6 100644
--- a/server.js
+++ b/server.js
@@ -90,7 +90,7 @@ var setHeaders = (function () {
         return function (req, res) {
             // apply a bunch of cross-origin headers for XLSX export in FF and printing elsewhere
             applyHeaderMap(res, {
-                "Cross-Origin-Opener-Policy": /^\/sheet\//.test(req.url)? 'same-origin': '',
+                "Cross-Origin-Opener-Policy": /^\/(sheet|presentation|doc|convert)\//.test(req.url)? 'same-origin': '',
             });
 
             if (Env.NO_SANDBOX) { // handles correct configuration for local development
diff --git a/www/checkup/main.js b/www/checkup/main.js
index 732197a2d..143d1709b 100644
--- a/www/checkup/main.js
+++ b/www/checkup/main.js
@@ -732,6 +732,36 @@ define([
         cb(isHTTPS(trimmedUnsafe) && isHTTPS(trimmedSafe));
     });
 
+
+    [
+        'sheet',
+        'presentation',
+        'doc',
+        'convert',
+    ].forEach(function (url) {
+        assert(function (cb, msg) {
+            var header = 'cross-origin-opener-policy';
+            var expected = 'same-origin';
+            deferredPostMessage({
+                command: 'GET_HEADER',
+                content: {
+                    url: '/' + url + '/',
+                    header: header,
+                }
+            }, function (content) {
+                msg.appendChild(h('span', [
+                    code(url),
+                    ' was served without the correct ',
+                    code(header),
+                    ' HTTP header value (',
+                    code(expected),
+                    '). This will interfere with your ability to convert between office file formats.'
+                ]));
+                cb(content === expected);
+            });
+        });
+    });
+
 /*
     assert(function (cb, msg) {
         setWarningClass(msg);
diff --git a/www/checkup/sandbox/main.js b/www/checkup/sandbox/main.js
index 7ddfb07f8..e11aa1d52 100644
--- a/www/checkup/sandbox/main.js
+++ b/www/checkup/sandbox/main.js
@@ -27,12 +27,14 @@ define([
     };
 
     window.addEventListener("message", function (event) {
+        var txid, command;
         if (event && event.data) {
             try {
                 //console.log(JSON.parse(event.data));
                 var msg = JSON.parse(event.data);
-                var command = msg.command;
-                var txid = msg.txid;
+                command = msg.command;
+                txid = msg.txid;
+                if (!txid) { return; }
                 COMMANDS[command](msg.content, function (response) {
                     // postMessage with same txid
                     postMessage({
@@ -41,7 +43,11 @@ define([
                     });
                 });
             } catch (err) {
-                console.error(err);
+                postMessage({
+                    txid: txid,
+                    content: err,
+                });
+                console.error(err, command);
             }
         } else {
             console.error(event);