From e08ca0423cd6f4a11f64f7f19795661dea82b0e2 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jakub=20Ko=C5=82odziejczak?=
 <31549762+mrl5@users.noreply.github.com>
Date: Mon, 7 Nov 2022 01:29:37 +0100
Subject: [PATCH] refactor(backend): improve memory footprint related to csp
 (#866)

---
 backend/windmill-api/src/lib.rs           |  5 ++---
 backend/windmill-api/src/static_assets.rs | 14 +++++++-------
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/backend/windmill-api/src/lib.rs b/backend/windmill-api/src/lib.rs
index cd3f4424e4..13ad53ea3e 100644
--- a/backend/windmill-api/src/lib.rs
+++ b/backend/windmill-api/src/lib.rs
@@ -47,7 +47,6 @@ const GIT_VERSION: &str = git_version!(args = ["--tag", "--always"], fallback =
 struct BaseUrl(String);
 pub struct IsSecure(bool);
 pub struct CloudHosted(bool);
-#[derive(Clone)]
 pub struct ContentSecurityPolicy(String);
 
 pub use users::delete_expired_items_perdiodically;
@@ -90,9 +89,9 @@ pub async fn run_server(
         .layer(Extension(Arc::new(IsSecure(
             base_url.starts_with("https://"),
         ))))
-        .layer(Extension(ContentSecurityPolicy(
+        .layer(Extension(Arc::new(ContentSecurityPolicy(
             std::env::var("SERVE_CSP").unwrap_or("".to_owned()),
-        )))
+        ))))
         .layer(Extension(http_client))
         .layer(CookieManagerLayer::new());
     // build our application with a route
diff --git a/backend/windmill-api/src/static_assets.rs b/backend/windmill-api/src/static_assets.rs
index 070e19fa37..1f024aa21e 100644
--- a/backend/windmill-api/src/static_assets.rs
+++ b/backend/windmill-api/src/static_assets.rs
@@ -23,16 +23,16 @@ pub async fn static_handler(
     uri: Uri,
     Extension(is_secure): Extension<Arc<IsSecure>>,
     Extension(is_cloud_hosted): Extension<Arc<CloudHosted>>,
-    Extension(csp): Extension<ContentSecurityPolicy>,
+    Extension(csp): Extension<Arc<ContentSecurityPolicy>>,
 ) -> impl IntoResponse {
     let path = uri.path().trim_start_matches('/').to_string();
-    StaticFile(path, is_secure.0, is_cloud_hosted.0, csp.0)
+    StaticFile(path, is_secure.0, is_cloud_hosted.0, csp)
 }
 
 #[derive(RustEmbed)]
 #[folder = "../../frontend/build/"]
 struct Asset;
-pub struct StaticFile<T>(pub T, pub bool, pub bool, pub String);
+pub struct StaticFile<T>(pub T, pub bool, pub bool, pub Arc<ContentSecurityPolicy>);
 
 impl<T> IntoResponse for StaticFile<T>
 where
@@ -46,7 +46,7 @@ where
     }
 }
 
-fn serve_path(path: String, can_set_security_headers: bool, csp: String) -> Response<BoxBody> {
+fn serve_path(path: String, can_set_security_headers: bool, csp: Arc<ContentSecurityPolicy>) -> Response<BoxBody> {
     if path.starts_with("api/") {
         return Response::builder()
             .status(404)
@@ -81,12 +81,12 @@ fn serve_path(path: String, can_set_security_headers: bool, csp: String) -> Resp
     }
 }
 
-fn set_security_headers(mut res: Builder, csp: String) -> Builder {
+fn set_security_headers(mut res: Builder, csp: Arc<ContentSecurityPolicy>) -> Builder {
     res = res.header("X-Frame-Options", "DENY");
     res = res.header("X-Content-Type-Options", "nosniff");
 
-    if !csp.is_empty() {
-        res = res.header("Content-Security-Policy", csp);
+    if !csp.0.is_empty() {
+        res = res.header("Content-Security-Policy", &csp.0);
     }
 
     res