added some security headers

7 files changed, 37 insertions, 56 deletions

diff --git a/hived/Dockerfile b/hived/Dockerfile
index da91fb7..138e02c 100644
--- a/hived/Dockerfile
+++ b/hived/Dockerfile
@@ -1,6 +1,7 @@
 FROM alpine:3.13 as builder
 RUN apk update && apk upgrade
 RUN apk add go git
+ENV GOPROXY=https://goproxy.io
 COPY go.* /hived/
 RUN cd /hived && go mod download
 COPY *.go /hived/
diff --git a/hived/go.mod b/hived/go.mod
index f2c87cc..126eedc 100644
--- a/hived/go.mod
+++ b/hived/go.mod
@@ -5,10 +5,22 @@ go 1.17
 require (
 	github.com/Knetic/govaluate v3.0.0+incompatible
 	github.com/go-redis/redis/v8 v8.6.0
-	github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible
 	github.com/gorilla/mux v1.8.0
 	github.com/rs/zerolog v1.20.0
-	github.com/technoweenie/multipartstreamer v1.0.1 // indirect
 	github.com/terminaldweller/grpc v1.0.3
 	google.golang.org/grpc v1.42.0
 )
+
+require (
+	github.com/cespare/xxhash/v2 v2.1.1 // indirect
+	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
+	github.com/golang/protobuf v1.5.2 // indirect
+	go.opentelemetry.io/otel v0.17.0 // indirect
+	go.opentelemetry.io/otel/metric v0.17.0 // indirect
+	go.opentelemetry.io/otel/trace v0.17.0 // indirect
+	golang.org/x/net v0.0.0-20201202161906-c7110b5ffcbb // indirect
+	golang.org/x/sys v0.0.0-20210112080510-489259a85091 // indirect
+	golang.org/x/text v0.3.3 // indirect
+	google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013 // indirect
+	google.golang.org/protobuf v1.27.1 // indirect
+)
diff --git a/hived/go.sum b/hived/go.sum
index b303f1e..e4621e0 100644
--- a/hived/go.sum
+++ b/hived/go.sum
@@ -31,8 +31,6 @@ github.com/fsnotify/fsnotify v1.4.9/go.mod h1:znqG4EE+3YCdAaPaxE2ZRY/06pZUdp0tY4
 github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
 github.com/go-redis/redis/v8 v8.6.0 h1:swqbqOrxaPztsj2Hf1p94M3YAgl7hYEpcw21z299hh8=
 github.com/go-redis/redis/v8 v8.6.0/go.mod h1:DQ9q4Rk2HtwkrwVrdgmphoOQDMfpvcd/nHEwRsicg8s=
-github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible h1:2cauKuaELYAEARXRkq2LrJ0yDDv1rW7+wrTEdVL3uaU=
-github.com/go-telegram-bot-api/telegram-bot-api v4.6.4+incompatible/go.mod h1:qf9acutJ8cwBUhm1bqgz6Bei9/C/c93FPDljKWwsOgM=
 github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
 github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
 github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
@@ -44,7 +42,6 @@ github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrU
 github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
 github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
 github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2 h1:+Z5KGCizgyZCbGh1KZqA0fcLLkwbsjIzS4aV2v7wJX0=
 github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
 github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
@@ -55,8 +52,8 @@ github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMyw
 github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
 github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.4 h1:L8R9j+yAqZuZjsqh/z+F1NCffTKKLShY6zXTItVIZ8M=
 github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
+github.com/google/go-cmp v0.5.5 h1:Khx7svrCpmxxtHBq5j2mp/xVjsi8hQMfNLvJFAlrGgU=
 github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
 github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.0 h1:i40aqfkR1h2SlN9hojwV5ZA91wcXFOvkdNIeFDP5koI=
@@ -85,8 +82,6 @@ github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0 h1:nwc3DEeHmmLAfoZucVR881uASk0Mfjw8xYJ99tb5CcY=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/technoweenie/multipartstreamer v1.0.1 h1:XRztA5MXiR1TIRHxH2uNxXxaIkKQDeX7m2XsSOlQEnM=
-github.com/technoweenie/multipartstreamer v1.0.1/go.mod h1:jNVxdtShOxzAsukZwTSw6MDx5eUJoiEBsSvzDU9uzog=
 github.com/terminaldweller/grpc v1.0.3 h1:yCRm0HKRD4M87CBmmO5KjkSFRq4X2lzHLJRH1ApzeiE=
 github.com/terminaldweller/grpc v1.0.3/go.mod h1:pYpuXZw8rHZwTABVEVZEfErFr+PyEhAaSrFm7y1yvTo=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -175,7 +170,6 @@ google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQ
 google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
 google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
 google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0 h1:4MY060fB1DLGMB/7MBTLnwQUY6+F09GEiz6SsrNqyzM=
 google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
@@ -183,7 +177,6 @@ google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp0
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/fsnotify.v1 v1.4.7/go.mod h1:Tz8NjZHkW78fSQdbUxIjBTcgA1z1m8ZHf0WmKUhAMys=
 gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkepLTh2hOroT7a+7czfdQ=
diff --git a/hived/hived.go b/hived/hived.go
index d00f58d..173e6c8 100644
--- a/hived/hived.go
+++ b/hived/hived.go
@@ -48,6 +48,16 @@ const (
 	SERVER_DEPLOYMENT_TYPE       = "SERVER_DEPLOYMENT_TYPE"
 )
 
+// OWASP: https://cheatsheetseries.owasp.org/cheatsheets/REST_Security_Cheat_Sheet.html
+func addSecureHeaders(w *http.ResponseWriter) {
+	(*w).Header().Set("Cache-Control", "no-store")
+	(*w).Header().Set("Content-Security-Policy", "default-src https;")
+	(*w).Header().Set("Strict-Transport-Security", "max-age=63072000;")
+	(*w).Header().Set("X-Content-Type-Options", "nosniff")
+	(*w).Header().Set("X-Frame-Options", "DENY")
+	(*w).Header().Set("Access-Control-Allow-Methods", "GET,POST,PUT,DELETE,OPTIONS")
+}
+
 func sendToTg(address, msg string, channelId int64) {
 	conn, err := grpc.Dial(address, grpc.WithInsecure())
 	if err != nil {
@@ -68,37 +78,6 @@ func sendToTg(address, msg string, channelId int64) {
 	log.Info().Msg(fmt.Sprintf("%v", r))
 }
 
-// func runTgBot() {
-// 	// bot := getTgBot()
-// 	token := os.Getenv(TELEGRAM_BOT_TOKEN_ENV_VAR)
-// 	bot, err := tgbotapi.NewBotAPI(token[1 : len(token)-1])
-// 	if err != nil {
-// 		log.Error().Err(err)
-// 	}
-// 	log.Debug().Msg("authorized on account bot_bloodstalker")
-
-// 	update := tgbotapi.NewUpdate(0)
-// 	update.Timeout = 60
-
-// 	updates, err := bot.GetUpdatesChan(update)
-// 	if err != nil {
-// 		log.Error().Err(err)
-// 	}
-
-// 	for update := range updates {
-// 		if update.Message == nil {
-// 			continue
-// 		}
-
-// 		log.Printf("[%s] %s", update.Message.From.UserName, update.Message.Text)
-
-// 		msg := tgbotapi.NewMessage(update.Message.Chat.ID, update.Message.Text)
-// 		msg.ReplyToMessageID = update.Message.MessageID
-
-// 		bot.Send(msg)
-// 	}
-// }
-
 type priceChanStruct struct {
 	name  string
 	price float64
@@ -153,6 +132,7 @@ func priceHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method != "GET" {
 		http.Error(w, "Method is not supported.", http.StatusNotFound)
 	}
+	addSecureHeaders(&w)
 
 	var name string
 	var unit string
@@ -216,6 +196,7 @@ func pairHandler(w http.ResponseWriter, r *http.Request) {
 	if r.Method != "GET" {
 		http.Error(w, "Method is not supported.", http.StatusNotFound)
 	}
+	addSecureHeaders(&w)
 
 	var one string
 	var two string
@@ -374,13 +355,7 @@ func alertManager() {
 			resultBool = result.(bool)
 			if resultBool == true {
 				token := os.Getenv(TELEGRAM_BOT_TOKEN_ENV_VAR)
-				// bot, err := tgbotapi.NewBotAPI(token[1 : len(token)-1])
-				// if err != nil {
-				// 	log.Error().Err(err)
-				// }
 				msgText := "notification " + alerts.Alerts[i].Expr + " has been triggered"
-				// msg := tgbotapi.NewMessage(*botChannelID, msgText)
-				// bot.Send(msg)
 				tokenInt, err := strconv.ParseInt(token[1:len(token)-1], 10, 64)
 				if err != nil {
 					log.Fatal().Err(err)
@@ -506,6 +481,7 @@ func handleAlertGet(w http.ResponseWriter, r *http.Request) {
 }
 
 func alertHandler(w http.ResponseWriter, r *http.Request) {
+	addSecureHeaders(&w)
 	if r.Method == "POST" || r.Method == "PUT" || r.Method == "PATCH" {
 		handleAlertPost(w, r)
 	} else if r.Method == "DELETE" {
@@ -519,6 +495,7 @@ func alertHandler(w http.ResponseWriter, r *http.Request) {
 
 func exHandler(w http.ResponseWriter, r *http.Request) {
 	w.Header().Add("Content-Type", "application/json")
+	addSecureHeaders(&w)
 	if r.Method != "GET" {
 		http.Error(w, "Method is not supported.", http.StatusNotFound)
 	}
@@ -586,6 +563,7 @@ func healthHandler(w http.ResponseWriter, r *http.Request) {
 	IsHivedOk := true
 	var IsRedisOk bool
 
+	addSecureHeaders(&w)
 	w.Header().Add("Content-Type", "application/json")
 	if r.Method != "GET" {
 		http.Error(w, "Method is not supported.", http.StatusNotFound)
@@ -620,6 +598,7 @@ func healthHandler(w http.ResponseWriter, r *http.Request) {
 
 func robotsHandler(w http.ResponseWriter, r *http.Request) {
 	w.Header().Add("Content-Type", "text/plain")
+	addSecureHeaders(&w)
 	json.NewEncoder(w).Encode(struct {
 		UserAgents string `json:"User-Agents"`
 		Disallow   string `json:"Disallow"`
@@ -696,7 +675,6 @@ func main() {
 	defer rdb.Close()
 
 	setupLogging()
-	// go runTgBot()
 	go alertManager()
 	startServer(gracefulWait)
 }
diff --git a/telebot/Dockerfile b/telebot/Dockerfile
index 8259880..134d6a5 100644
--- a/telebot/Dockerfile
+++ b/telebot/Dockerfile
@@ -1,6 +1,7 @@
 FROM alpine:3.13 as builder
 RUN apk update && apk upgrade
 RUN apk add go git
+ENV GOPROXY=https://goproxy.io
 COPY go.* /telebot/
 RUN cd /telebot && go mod download
 COPY *.go /telebot/
diff --git a/telebot/go.sum b/telebot/go.sum
index 5b1e0a1..ba1d9b7 100644
--- a/telebot/go.sum
+++ b/telebot/go.sum
@@ -138,7 +138,6 @@ google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2
 google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
 google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0 h1:bxAC2xTBsZGibn2RTntX0oH50xLsqy1OxA9tTL3p/lk=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
 google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
 google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
diff --git a/test/endpoints.sh b/test/endpoints.sh
index 11282bb..6263136 100755
--- a/test/endpoints.sh
+++ b/test/endpoints.sh
@@ -2,10 +2,7 @@
 set -e
 set -x
 
-sleep 5
-curl -X GET http://localhost:8008/price?name=CAKE&unit=USD
-curl -X GET http://localhost:8008/pair?one=ETH&two=CAKE&multiplier=4.0
-curl -X POST -H "Content-Type: application/json" -d '{"name":"alert1", "expr":"ETH>CAKE"}' http://localhost:8008/alert
-# curl -X GET http://127.0.0.1:8008/price?name=CAKE&unit=USD
-# curl -X GET http://127.0.0.1:8008/pair?one=ETH&two=CAKE&multiplier=4.0
-# curl -X POST -H "Content-Type: application/json" -d '{"name":"alert1", "expr":"ETH>CAKE"}' http://127.0.0.1:8008/alert
+# sleep 5
+curl -k -X GET https://localhost:8008/crypto/price?name=CAKE&unit=USD
+curl -k -X GET https://localhost:8008/crypto/pair?one=ETH&two=CAKE&multiplier=4.0
+curl -k -X POST -H "Content-Type: application/json" -d '{"name":"alert1", "expr":"ETH>CAKE"}' https://localhost:8008/crypto/alert