package bridge
import (
"crypto/rand"
"encoding/base64"
"encoding/json"
"errors"
"strconv"
"strings"
"github.com/telegramdesktop/tproxy-server/internal/config"
)
type Page struct {
Body []byte
Nonce string
CSP string
}
const PermissionsPolicy = "accelerometer=(), autoplay=(), camera=(), clipboard-read=(), clipboard-write=(), display-capture=(), encrypted-media=(), fullscreen=(), geolocation=(), gyroscope=(), hid=(), idle-detection=(), magnetometer=(), microphone=(), midi=(), payment=(), picture-in-picture=(), publickey-credentials-create=(), publickey-credentials-get=(), screen-wake-lock=(), serial=(), usb=(), web-share=(), xr-spatial-tracking=()"
func Render(hostname, bootstrapToken, carrierMode string, batchBytes int) (Page, error) {
if err := config.ValidateHostname(hostname); err != nil {
return Page{}, err
}
if batchBytes <= 0 || batchBytes > config.MaxCarrierBatchBytes {
return Page{}, errors.New("carrier batch size out of range")
}
if !config.CarrierMode(carrierMode).Valid() {
return Page{}, errors.New("invalid carrier mode")
}
nonceBytes := make([]byte, 18)
if _, err := rand.Read(nonceBytes); err != nil {
return Page{}, err
}
nonce := base64.RawURLEncoding.EncodeToString(nonceBytes)
hostJSON, _ := json.Marshal("https://" + hostname)
tokenJSON, _ := json.Marshal(bootstrapToken)
carrierJSON, _ := json.Marshal(carrierMode)
body := strings.ReplaceAll(document, "__NONCE__", nonce)
body = strings.ReplaceAll(body, "__ORIGIN__", string(hostJSON))
body = strings.ReplaceAll(body, "__BOOTSTRAP__", string(tokenJSON))
body = strings.ReplaceAll(body, "__CARRIER_MODE__", string(carrierJSON))
body = strings.ReplaceAll(body, "__BATCH_LIMIT__", strconv.Itoa(batchBytes))
if strings.Contains(body, "__NONCE__") || strings.Contains(body, "__ORIGIN__") || strings.Contains(body, "__BOOTSTRAP__") || strings.Contains(body, "__CARRIER_MODE__") || strings.Contains(body, "__BATCH_LIMIT__") {
return Page{}, errors.New("bridge template replacement failed")
}
return Page{
Body: []byte(body),
Nonce: nonce,
CSP: strings.Join([]string{
"default-src 'none'",
"base-uri 'none'",
"child-src 'none'",
"connect-src 'self' wss://" + hostname,
"font-src 'none'",
"form-action 'none'",
"frame-ancestors http://127.0.0.1:*",
"frame-src 'none'",
"img-src 'none'",
"manifest-src 'none'",
"media-src 'none'",
"object-src 'none'",
"script-src 'nonce-" + nonce + "'",
"style-src 'none'",
"worker-src 'none'",
"sandbox allow-same-origin allow-scripts",
}, "; "),
}, nil
}
const document = `
Connection
`