@botfabrik/engine-webclient 4.110.3 → 4.110.4

package/dist/applySecurityMiddleware.js

@@ -8,17 +8,17 @@ import helmet from 'helmet';
  * @param baseUrl - The server's own base URL (e.g. "http://localhost:3000").
  */
 export function applySecurityMiddleware(router, props, baseUrl) {
-    const { allowedOrigins, trustedResourceOrigins } = props;
+    const { allowedEmbedOrigins, allowedResourceOrigins } = props;
     // CORS
-    // When allowedOrigins is undefined, all origins are permitted (backward-compatible default).
+    // When allowedEmbedOrigins is undefined, all origins are permitted (backward-compatible default).
     // When it is set (even to an empty array), only the listed origins plus the server's own
     // base URL are allowed.
     router.use(cors({
-        origin: allowedOrigins === undefined
+        origin: allowedEmbedOrigins === undefined
             ? true
             : (origin, callback) => {
                 // The server's own origin is always allowed.
-                const effectiveAllowed = [baseUrl, ...allowedOrigins];
+                const effectiveAllowed = [baseUrl, ...allowedEmbedOrigins];
                 if (!origin || effectiveAllowed.includes(origin)) {
                     callback(null, true);
                 }
@@ -36,30 +36,30 @@ export function applySecurityMiddleware(router, props, baseUrl) {
             directives: {
                 defaultSrc: ["'self'"],
                 scriptSrc: ["'self'"],
-                // stylesheets: allow all HTTPS sources when no trustedResourceOrigins are configured
+                // stylesheets: allow all HTTPS sources when no allowedResourceOrigins are configured
                 // (backward-compatible default); otherwise restrict to the listed origins
-                styleSrc: trustedResourceOrigins === undefined
+                styleSrc: allowedResourceOrigins === undefined
                     ? ["'self'", "'unsafe-inline'", 'https:']
-                    : ["'self'", "'unsafe-inline'", ...trustedResourceOrigins],
-                // images: restrict to trusted resource origins when defined, otherwise allow all HTTPS
-                imgSrc: trustedResourceOrigins === undefined
+                    : ["'self'", "'unsafe-inline'", ...allowedResourceOrigins],
+                // images: restrict to allowed resource origins when defined, otherwise allow all HTTPS
+                imgSrc: allowedResourceOrigins === undefined
                     ? ["'self'", 'data:', 'https:']
-                    : ["'self'", 'data:', ...trustedResourceOrigins],
+                    : ["'self'", 'data:', ...allowedResourceOrigins],
                 connectSrc: [
                     "'self'",
                     // allow websocket connections back to the same server
                     baseUrl.replace(/^http/, 'ws'),
                     baseUrl.replace(/^http/, 'wss'),
                 ],
-                // fonts may be loaded from trusted resource origins (e.g. Google Fonts);
-                // when no trustedResourceOrigins are configured, allow fonts from all origins
-                fontSrc: trustedResourceOrigins === undefined
+                // fonts may be loaded from allowed resource origins (e.g. Google Fonts);
+                // when no allowedResourceOrigins are configured, allow fonts from all origins
+                fontSrc: allowedResourceOrigins === undefined
                     ? ['*']
-                    : ["'self'", ...trustedResourceOrigins],
-                // when no allowedOrigins are configured, allow framing from all origins
-                frameAncestors: allowedOrigins === undefined
+                    : ["'self'", ...allowedResourceOrigins],
+                // when no allowedEmbedOrigins are configured, allow framing from all origins
+                frameAncestors: allowedEmbedOrigins === undefined
                     ? ['*']
-                    : ["'self'", ...allowedOrigins],
+                    : ["'self'", ...allowedEmbedOrigins],
                 // frame-src controls what this page may embed in an iframe.
                 // The /embed page loads the chatbot in an iframe on the same server.
                 // We include both http and https of the server's base URL because a browser
@@ -69,7 +69,7 @@ export function applySecurityMiddleware(router, props, baseUrl) {
                     "'self'",
                     baseUrl,
                     baseUrl.replace(/^http:/, 'https:'),
-                    ...(allowedOrigins ?? []),
+                    ...(allowedEmbedOrigins ?? []),
                 ],
                 objectSrc: ["'none'"],
                 baseUri: ["'self'"],

package/dist/applySecurityMiddleware.test.js

@@ -5,47 +5,47 @@ import { applySecurityMiddleware } from './applySecurityMiddleware.js';
 const BASE_URL = 'http://localhost:3000';
 describe('security middleware', () => {
     describe('CORS', () => {
-        it('allows all origins when allowedOrigins is undefined', async () => {
+        it('allows all origins when allowedEmbedOrigins is undefined', async () => {
             const res = await supertest(makeApp({}))
                 .get('/')
                 .set('Origin', 'http://any-origin.example.com');
             expect(res.headers['access-control-allow-origin']).toBe('http://any-origin.example.com');
         });
-        it('allows the server baseUrl when allowedOrigins is []', async () => {
-            const res = await supertest(makeApp({ allowedOrigins: [] }))
+        it('allows the server baseUrl when allowedEmbedOrigins is []', async () => {
+            const res = await supertest(makeApp({ allowedEmbedOrigins: [] }))
                 .get('/')
                 .set('Origin', BASE_URL);
             expect(res.headers['access-control-allow-origin']).toBe(BASE_URL);
         });
         it('allows an explicitly listed origin', async () => {
-            const res = await supertest(makeApp({ allowedOrigins: ['http://example.com'] }))
+            const res = await supertest(makeApp({ allowedEmbedOrigins: ['http://example.com'] }))
                 .get('/')
                 .set('Origin', 'http://example.com');
             expect(res.headers['access-control-allow-origin']).toBe('http://example.com');
         });
         it('rejects an unlisted origin', async () => {
-            const res = await supertest(makeApp({ allowedOrigins: ['http://example.com'] }))
+            const res = await supertest(makeApp({ allowedEmbedOrigins: ['http://example.com'] }))
                 .get('/')
                 .set('Origin', 'http://evil.example.com');
             // cors package sets the header to false/omits it when rejected
             expect(res.headers['access-control-allow-origin']).toBeUndefined();
         });
-        it('allows no-origin requests (same-origin non-browser) regardless of allowedOrigins', async () => {
-            const res = await supertest(makeApp({ allowedOrigins: [] })).get('/');
+        it('allows no-origin requests (same-origin non-browser) regardless of allowedEmbedOrigins', async () => {
+            const res = await supertest(makeApp({ allowedEmbedOrigins: [] })).get('/');
             expect(res.status).toBe(200);
         });
     });
     describe('CSP frame-ancestors', () => {
-        it("is '*' when allowedOrigins is undefined", async () => {
+        it("is '*' when allowedEmbedOrigins is undefined", async () => {
             const res = await supertest(makeApp({})).get('/');
             expect(res.headers['content-security-policy']).toContain('frame-ancestors *');
         });
-        it('is "\'self\'" + listed origin when allowedOrigins is set', async () => {
-            const res = await supertest(makeApp({ allowedOrigins: ['http://example.com'] })).get('/');
+        it('is "\'self\'" + listed origin when allowedEmbedOrigins is set', async () => {
+            const res = await supertest(makeApp({ allowedEmbedOrigins: ['http://example.com'] })).get('/');
             expect(res.headers['content-security-policy']).toContain("frame-ancestors 'self' http://example.com");
         });
-        it('is "\'self\'" only when allowedOrigins is []', async () => {
-            const res = await supertest(makeApp({ allowedOrigins: [] })).get('/');
+        it('is "\'self\'" only when allowedEmbedOrigins is []', async () => {
+            const res = await supertest(makeApp({ allowedEmbedOrigins: [] })).get('/');
             expect(res.headers['content-security-policy']).toContain("frame-ancestors 'self'");
         });
     });
@@ -57,7 +57,7 @@ describe('security middleware', () => {
             expect(csp).toContain('wss://bot.example.com');
         });
     });
-    describe('CSP trustedResourceOrigins', () => {
+    describe('CSP allowedResourceOrigins', () => {
         it('allows all HTTPS for styleSrc/imgSrc/fontSrc when undefined', async () => {
             const res = await supertest(makeApp({})).get('/');
             const csp = res.headers['content-security-policy'];
@@ -66,7 +66,7 @@ describe('security middleware', () => {
             expect(csp).toContain('font-src *');
         });
         it('restricts styleSrc/imgSrc/fontSrc to listed origins when set', async () => {
-            const res = await supertest(makeApp({ trustedResourceOrigins: ['https://fonts.googleapis.com'] })).get('/');
+            const res = await supertest(makeApp({ allowedResourceOrigins: ['https://fonts.googleapis.com'] })).get('/');
             const csp = res.headers['content-security-policy'];
             expect(csp).toContain('https://fonts.googleapis.com');
             expect(csp).not.toContain('font-src *');