Initial QSfera import

Server/devtools/deployments/service_policies/policies/postprocessing.rego

@@ -0,0 +1,17 @@
+package postprocessing
+
+import future.keywords.if
+import data.utils
+
+default granted := true
+
+granted = false if {
+    not utils.is_extension_allowed(input.resource.name)
+}
+
+granted = false if {
+    bytes := qsfera.resource.download(input.resource.url)
+    mimetype := qsfera.mimetype.detect(bytes)
+
+    not utils.is_mimetype_allowed(mimetype)
+}

Server/devtools/deployments/service_policies/policies/proxy.rego

@@ -0,0 +1,33 @@
+package proxy
+
+import future.keywords.if
+import data.utils
+
+default granted := true
+
+granted = false if {
+    input.request.method == "PUT"
+    pathPrefixes := [
+        "/dav",
+        "/remote.php/webdav",
+        "/remote.php/dav",
+        "/webdav",
+    ]
+    restricted := pathPrefixes[_]
+    startswith(input.request.path, restricted)
+    not utils.is_extension_allowed(input.resource.name)
+}
+
+granted = false if {
+    input.request.method == "POST"
+    pathPrefixes := [
+        "/data",
+        "/dav",
+        "/remote.php/webdav",
+        "/remote.php/dav",
+        "/webdav",
+    ]
+    restricted := pathPrefixes[_]
+    startswith(input.request.path, restricted)
+    not utils.is_extension_allowed(input.resource.name)
+}

Server/devtools/deployments/service_policies/policies/utils.rego

@@ -0,0 +1,22 @@
+package utils
+
+ALLOWED_RESOURCE_EXTENSIONS := [
+    ".apk", ".avi", ".bat", ".bmp", ".css", ".csv", ".doc", ".docm", ".docx",
+    ".docxf", ".dotx", ".eml", ".epub", ".htm", ".html", ".ipa", ".jar", ".java",
+    ".jpg", ".js", ".json", ".mp3", ".mp4", ".msg", ".odp", ".ods", ".odt", ".oform",
+    ".ots", ".ott", ".pdf", ".php", ".png", ".potm", ".potx", ".ppsm", ".ppsx", ".ppt",
+    ".pptm", ".pptx", ".py", ".rtf", ".sb3", ".sprite3", ".sql", ".svg", ".tif", ".tiff",
+    ".txt", ".xls", ".xlsm", ".xlsx", ".xltm", ".xltx", ".xml", ".zip", ".md"
+]
+
+is_extension_allowed(identifier) {
+     extension := ALLOWED_RESOURCE_EXTENSIONS[_]
+     endswith(identifier, extension)
+}
+
+is_mimetype_allowed(mimetype) {
+     extensions := qsfera.mimetype.extensions(mimetype)
+     extension := extensions[_]
+     is_extension_allowed(extension)
+}
+