feat: Improve Application Security

CHANGELOG.md

@@ -12,9 +12,12 @@ You can also check the
 # Unreleased
 
 - Features
+  - Implemented Content Security Policy (CSP)
   - It's now possible to export charts as images
   - Added Footer to the Profile Page
 - Fixes
+  - Addressed security flaw allowing the injection of arbitrary URLs
+    in the `sourceUrl` parameter in the GraphQL API
   - Color mapping is now correctly kept up to date in case of editing an old
     chart and the cube has been updated in the meantime and contains new values
     in the color dimension
@@ -51,6 +54,7 @@ You can also check the
   - Added auto-generated JSON Schema files for configurator state and chart
     config and improved preview charts via API documentation
 
+
 # [5.0.2] - 2024-11-28
 
 - Features

app/domain/datasource/index.ts

@@ -7,6 +7,8 @@ import {
 } from "@/domain/datasource/constants";
 import { ENDPOINT } from "@/domain/env";
 
+export { isDataSourceUrlAllowed, type DataSourceUrl } from "./urls";
+
 export const parseDataSource = (stringifiedSource: string): DataSource => {
   const [type, url] = stringifiedSource.split("+") as [
     DataSource["type"],

app/domain/datasource/urls.ts

@@ -0,0 +1,17 @@
+import { SOURCE_OPTIONS } from "@/domain/datasource/constants";
+
+const allowedSourceLabels = JSON.parse(
+  process.env.WHITELISTED_DATA_SOURCES ?? "[]"
+);
+
+const allowedSources = SOURCE_OPTIONS.filter((o) =>
+  allowedSourceLabels.includes(o.label)
+);
+
+const allowedDataSourceUrls = allowedSources.map((o) => o.value.split("+")[1]);
+
+export type DataSourceUrl = string & {};
+
+export const isDataSourceUrlAllowed = (url: string): url is DataSourceUrl => {
+  return typeof url === "string" && allowedDataSourceUrls.includes(url);
+};

app/graphql/queries/data-cubes.graphql

@@ -1,6 +1,6 @@
 query SearchCubes(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $locale: String!
   $query: String
   $order: SearchCubeResultOrder
@@ -26,7 +26,7 @@ query SearchCubes(
 
 query DataCubeLatestIri(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $cubeFilter: DataCubeLatestIriFilter!
 ) {
   dataCubeLatestIri(
@@ -50,7 +50,7 @@ query DataCubeUnversionedIri(
 
 query DataCubeComponents(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $locale: String!
   $cubeFilter: DataCubeComponentFilter!
 ) {
@@ -64,7 +64,7 @@ query DataCubeComponents(
 
 query DataCubeDimensionGeoShapes(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $locale: String!
   $cubeFilter: DataCubeDimensionGeoShapesCubeFilter!
 ) {
@@ -78,7 +78,7 @@ query DataCubeDimensionGeoShapes(
 
 query DataCubeMetadata(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $locale: String!
   $cubeFilter: DataCubeMetadataFilter!
 ) {
@@ -92,7 +92,7 @@ query DataCubeMetadata(
 
 query DataCubeComponentTermsets(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $locale: String!
   $cubeFilter: DataCubeTermsetFilter!
 ) {
@@ -106,7 +106,7 @@ query DataCubeComponentTermsets(
 
 query DataCubeObservations(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $locale: String!
   $cubeFilter: DataCubeObservationFilter!
 ) {
@@ -120,7 +120,7 @@ query DataCubeObservations(
 
 query DataCubePreview(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $locale: String!
   $cubeFilter: DataCubePreviewFilter!
 ) {
@@ -134,7 +134,7 @@ query DataCubePreview(
 
 query PossibleFilters(
   $sourceType: String!
-  $sourceUrl: String!
+  $sourceUrl: DataSourceUrl!
   $cubeFilter: DataCubePossibleFiltersCubeFilter!
 ) {
   possibleFilters(