@appsemble/node-utils 0.35.17 → 0.35.18

package/README.md

@@ -1,9 +1,9 @@
-# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.35.17/config/assets/logo.svg) Appsemble Node Utilities
+# ![](https://gitlab.com/appsemble/appsemble/-/raw/0.35.18/config/assets/logo.svg) Appsemble Node Utilities
 
 > NodeJS utilities used by Appsemble internally.
 
 [![npm](https://img.shields.io/npm/v/@appsemble/node-utils)](https://www.npmjs.com/package/@appsemble/node-utils)
-[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.35.17/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.35.17)
+[![GitLab CI](https://gitlab.com/appsemble/appsemble/badges/0.35.18/pipeline.svg)](https://gitlab.com/appsemble/appsemble/-/releases/0.35.18)
 [![Prettier](https://img.shields.io/badge/code_style-prettier-ff69b4.svg)](https://prettier.io)
 
 ## Table of Contents
@@ -26,5 +26,5 @@ compatibility is not guaranteed.
 
 ## License
 
-[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.35.17/LICENSE.md) ©
+[LGPL-3.0-only](https://gitlab.com/appsemble/appsemble/-/blob/0.35.18/LICENSE.md) ©
 [Appsemble](https://appsemble.com)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@appsemble/node-utils",
-  "version": "0.35.17",
+  "version": "0.35.18",
   "description": "NodeJS utilities used by Appsemble internally.",
   "keywords": [
     "app",
@@ -40,9 +40,9 @@
     "test": "vitest"
   },
   "dependencies": {
-    "@appsemble/lang-sdk": "0.35.17",
-    "@appsemble/types": "0.35.17",
-    "@appsemble/utils": "0.35.17",
+    "@appsemble/lang-sdk": "0.35.18",
+    "@appsemble/types": "0.35.18",
+    "@appsemble/utils": "0.35.18",
     "@formatjs/fast-memoize": "^2.0.0",
     "@fortawesome/fontawesome-free": "^6.0.0",
     "@kubernetes/client-node": "^0.22.2",

package/render.d.ts

@@ -4,11 +4,12 @@ import { type Context } from 'koa';
  * Render settings as an HTML script tag.
  *
  * @param settings The settings to render. This must be a JSON serializable object.
+ * @param nonce The settings nonce.
  * @param statements Custom JavaScript statements to append.
  * @returns A tuple of the digest and the HTML script tag. The digest should be added to the CSP
  *   `script-src`.
  */
-export declare function createSettings(settings: unknown, statements?: string[]): [digest: string, script: string];
+export declare function createSettings(settings: unknown, nonce?: string, statements?: string[]): [digest: string, script: string];
 export declare function render(ctx: Context, filename: string, data: Record<string, unknown>): Promise<void>;
 /**
  * Convert a CSP key / values pair object into a real content security policy string.

package/render.js

@@ -6,14 +6,18 @@ import mustache from 'mustache';
  * Render settings as an HTML script tag.
  *
  * @param settings The settings to render. This must be a JSON serializable object.
+ * @param nonce The settings nonce.
  * @param statements Custom JavaScript statements to append.
  * @returns A tuple of the digest and the HTML script tag. The digest should be added to the CSP
  *   `script-src`.
  */
-export function createSettings(settings, statements = []) {
+export function createSettings(settings, nonce, statements = []) {
     const script = [`window.settings=${JSON.stringify(settings)}`, ...statements].join(';');
     const hash = createHash('sha256').update(script, 'utf8').digest('base64');
-    return [`'sha256-${hash}'`, `<script>${script}</script>`];
+    return [
+        `'sha256-${hash}'`,
+        nonce ? `<script nonce="${nonce}">${script}</script>` : `<script>${script}</script>`,
+    ];
 }
 export async function render(ctx, filename, data) {
     if (process.env.NODE_ENV === 'test') {

package/server/routes/appRouter/indexHandler.js

@@ -39,6 +39,7 @@ export function createIndexHandler({ createSettings, getApp, getAppDetails, getA
             ...new Set([...appMessages.map(({ language }) => language), defaultLanguage]),
         ].sort();
         const identifiableBlocks = getAppBlocks(app.definition);
+        const nonce = randomBytes(16).toString('base64');
         const [settingsHash, settings] = await createSettings({
             context: ctx,
             app,
@@ -46,8 +47,8 @@ export function createIndexHandler({ createSettings, getApp, getAppDetails, getA
             hostname,
             identifiableBlocks,
             languages,
+            nonce,
         });
-        const nonce = randomBytes(16).toString('base64');
         const csp = getCsp({ app, settingsHash, hostname, host, nonce });
         ctx.set('Content-Security-Policy', makeCSP(csp));
         const updated = app.$updated ? new Date(app.$updated) : new Date();

package/server/types.d.ts

@@ -204,6 +204,7 @@ export interface CreateSettingsParams {
     controllerDefinition?: ControllerDefinition;
     hostname: string;
     languages: string[];
+    nonce: string;
 }
 export interface GetCspParams {
     app: App;