@dwp/govuk-casa 8.0.0-beta2 → 8.0.3

package/dist/middleware/body-parser.js

@@ -1,10 +1,24 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyBody = void 0;
 const express_1 = require("express");
+const rProto = /__proto__/i;
+const rPrototype = /prototype[='"[\]]/i;
+const rConstructor = /constructor[='"[\]]/i;
+function verifyBody(req, res, buf, encoding) {
+    const body = decodeURI(buf.toString(encoding));
+    if (rProto.test(body)) {
+        throw new Error('Request body verification failed (__proto__)');
+    }
+    if (rPrototype.test(body)) {
+        throw new Error('Request body verification failed (prototype)');
+    }
+    if (rConstructor.test(body)) {
+        throw new Error('Request body verification failed (constructor)');
+    }
+}
+exports.verifyBody = verifyBody;
 function bodyParserMiddleware() {
-    const rProto = /__proto__/i;
-    const rPrototype = /prototype[='"[\]]/i;
-    const rConstructor = /constructor[='"[\]]/i;
     return [
         (0, express_1.urlencoded)({
             extended: true,
@@ -12,12 +26,7 @@ function bodyParserMiddleware() {
             inflate: true,
             parameterLimit: 25,
             limit: 1024 * 50,
-            verify: (req, res, buf, encoding) => {
-                const body = decodeURI(buf.toString(encoding));
-                if (rProto.test(body) || rPrototype.test(body) || rConstructor.test(body)) {
-                    throw new Error('Request body verification failed');
-                }
-            },
+            verify: verifyBody,
         }),
     ];
 }

package/dist/middleware/data.js

@@ -37,15 +37,19 @@ function dataMiddleware({ plan, mountUrl, events, }) {
             // CASA and userland templates
             res.locals.casa = {
                 mountUrl,
+                editMode: req.casa.editMode,
+                editOrigin: req.casa.editOrigin,
             };
             res.locals.locale = req.language;
             // Used by govuk-frontend template
             // - req.language is provided by i18n-http-middleware
             res.locals.htmlLang = req.language;
-            // Function for building URLs. This will be curried with the `mountUrl`
-            // and `journeyContext` for convenience
-            res.locals.waypointUrl = (args) => (0, waypoint_url_js_1.default)(Object.assign({ mountUrl, journeyContext: req.casa.journeyContext }, args));
-            // req.editSearchParams
+            // Function for building URLs. This will be curried with the `mountUrl`,
+            // `journeyContext`, `edit` and `editOrigin` for convenience. This means
+            // the template author does not have to be concerned about the current
+            // "state" when generating URLs, but still has the ability to override
+            // these curried defaults if needs be.
+            res.locals.waypointUrl = (args) => (0, waypoint_url_js_1.default)(Object.assign({ mountUrl, journeyContext: req.casa.journeyContext, edit: req.casa.editMode, editOrigin: req.casa.editOrigin }, args));
             next();
         },
     ];

package/dist/middleware/dirname.cjs

@@ -1 +1 @@
-module.exports = __dirname;
+module.exports = __dirname;

package/dist/middleware/gather-fields.js

@@ -28,21 +28,19 @@ exports.default = ({ waypoint, fields = [], }) => [
         // for any comparison work that may be done in subseqent middleware.
         req.casa.archivedJourneyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
         // Ignore data for any non-persistent fields
+        // ESLint disabled as `fields`, `i` and `name` are dev-controlled
+        /* eslint-disable security/detect-object-injection */
         const persistentBody = Object.create(null);
         for (let i = 0, l = fields.length; i < l; i++) {
             if (fields[i].meta.persist && fields[i].getValue(req.body) !== undefined) {
                 persistentBody[fields[i].name] = fields[i].getValue(req.body);
             }
         }
+        /* eslint-enable security/detect-object-injection */
         // Update data and validation context in the current request, and store
         req.casa.journeyContext.setDataForPage(waypoint, persistentBody);
         req.casa.journeyContext.removeValidationStateForPage(waypoint);
         JourneyContext_js_1.default.putContext(req.session, req.casa.journeyContext);
-        // TODO: Once feature we might like here is to invalidate specific pages
-        // based on the change that has just happened, to force those pages to be
-        // visited again. The main use case is to cater for a change in content on
-        // those pages that fundamentally alter the context of the question being asked,
-        // and so should be asked again. For example, "Your address" vs "You and your partner's address"
         next();
     },
 ];

package/dist/middleware/i18n.js

@@ -10,7 +10,7 @@ const fs_1 = require("fs");
 const deepmerge_1 = __importDefault(require("deepmerge"));
 const js_yaml_1 = __importDefault(require("js-yaml"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
-const log = (0, logger_js_1.default)('middleware.i18n');
+const log = (0, logger_js_1.default)('middleware:i18n');
 const loadJson = (file) => {
     // Strip out newlines (this is a legacy feature which we're keeping for
     // backwards compatibility).
@@ -29,6 +29,9 @@ const extract = (file) => {
 const loadResources = (languages, directories) => {
     const store = Object.create(null);
     languages.forEach((language) => {
+        // ESLint disabled as `store`, `language` and `ns` are all dev-controlled,
+        // and this function is only called once, at boot-time.
+        /* eslint-disable security/detect-object-injection */
         store[language] = Object.create(null);
         directories.forEach((basedir) => {
             const dir = (0, path_1.resolve)(basedir, language);
@@ -44,6 +47,7 @@ const loadResources = (languages, directories) => {
                 store[language][ns] = (0, deepmerge_1.default)(store[language][ns], data);
             });
         });
+        /* eslint-enable security/detect-object-injection */
     });
     return store;
 };

package/dist/middleware/post.js

@@ -9,7 +9,7 @@ const log = (0, logger_js_1.default)('middleware:post');
 function postMiddleware({ mountUrl, }) {
     return [
         (req, res) => {
-            res.render('casa/errors/404.njk');
+            res.status(404).render('casa/errors/404.njk');
         },
         /* eslint-disable-next-line no-unused-vars */
         (err, req, res, next) => {

package/dist/middleware/pre.js

@@ -5,6 +5,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const helmet_1 = __importDefault(require("helmet"));
+const GA_DOMAIN = 'www.google-analytics.com';
+const GTM_DOMAIN = 'www.googletagmanager.com';
 exports.default = () => [
     // Only allow certain request methods
     (req, res, next) => {
@@ -40,9 +42,15 @@ exports.default = () => [
         contentSecurityPolicy: {
             useDefaults: true,
             directives: {
-                'script-src': ["'self'", 'www.google-analytics.com', 'www.googletagmanager.com', (req, res) => `'nonce-${res.locals.cspNonce}'`],
-                'style-src': ["'self'", 'https:', (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'default-src': ["'none'"],
+                'script-src': ["'self'", GA_DOMAIN, GTM_DOMAIN, (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'img-src': ["'self'", GA_DOMAIN],
+                'connect-src': ["'self'", GA_DOMAIN],
+                'frame-src': ["'self'", GTM_DOMAIN],
+                'frame-ancestors': ["'self'"],
                 'form-action': ["'self'"],
+                'style-src': ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
+                'font-src': ["'self'"],
             },
         },
         // // Require referrer to aid navigation

package/dist/middleware/progress-journey.js

@@ -26,7 +26,7 @@ exports.default = ({ waypoint, plan, mountUrl, }) => [
         const traversed = plan.traverse(req.casa.journeyContext);
         const currentIndex = traversed.indexOf(waypoint);
         const nextIndex = Math.max(currentIndex < 0 ? traversed.length - 1 : 0, Math.min(currentIndex + 1, traversed.length - 1));
-        const nextWaypoint = traversed[nextIndex];
+        const nextWaypoint = traversed[parseInt(nextIndex, 10)];
         log.trace(`currentIndex = ${currentIndex}, nextIndex = ${nextIndex}, currentWaypoint = ${waypoint}, nextWaypoint = ${nextWaypoint}`);
         // Edit mode
         // Attempt to take the user back to their original URL. We rely on the

package/dist/middleware/sanitise-fields.js

@@ -20,23 +20,23 @@ exports.default = ({ waypoint, fields = [], }) => {
         (req, res, next) => {
             // First, prune all undefined, or unknown fields from `req.body` (i.e.
             // those that do not have an entry in `fields`)
+            // EsLint disabled as `fields`, `i` & `name` are only controlled by dev
+            /* eslint-disable security/detect-object-injection */
             const prunedBody = Object.create(null);
             for (let i = 0, l = fields.length; i < l; i++) {
                 if (lodash_1.default.has(req.body, fields[i].name) && req.body[fields[i].name] !== undefined) {
                     prunedBody[fields[i].name] = req.body[fields[i].name];
                 }
             }
-            // TODO: the journey context passed to the processors and conditions, with
-            // data set to the "prunedBody"
+            /* eslint-enable security/detect-object-injection */
             const journeyContext = JourneyContext_js_1.default.fromContext(req.casa.journeyContext);
             journeyContext.setDataForPage(waypoint, prunedBody);
-            // const journeyContext = {};
             // Second, prune any fields that do not pass the validation conditional,
             // and process those that do.
             const sanitisedBody = Object.create(null);
             for (let i = 0, l = fields.length; i < l; i++) {
-                const field = fields[i];
-                const fieldValue = field.getValue(prunedBody); // prunedBody[field.name];
+                const field = fields[i]; /* eslint-disable-line security/detect-object-injection */
+                const fieldValue = field.getValue(prunedBody);
                 if (fieldValue !== undefined && field.testConditions({
                     fieldValue,
                     waypoint,

package/dist/middleware/session.js

@@ -28,6 +28,57 @@ Object.defineProperty(exports, "__esModule", { value: true });
 const express_session_1 = __importStar(require("express-session"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const log = (0, logger_js_1.default)('middleware:session');
+const sessionExpiryMiddleware = (mountUrl, ttl, getCookie, touchCookie, removeCookie) => (req, res, next) => {
+    var _a;
+    const lastModified = getCookie(req);
+    const age = Math.floor(Date.now() * 0.001) - lastModified;
+    if (lastModified === 0) {
+        // New session, or grace period cookie no longer available after
+        // expiring; generate a new session, and create grace-period cookie.
+        // This will invalidate any CSRF tokens, so by letting the request POST
+        // requests through the user may see a 500 error response.
+        log.info('Session is new, or grace period has expired. Regenerating session.');
+        req.session.regenerate((err) => {
+            if (err) {
+                next(err);
+            }
+            else {
+                touchCookie(res);
+                if (req.method === 'POST') {
+                    log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
+                    res.redirect(302, mountUrl);
+                }
+                else {
+                    next();
+                }
+            }
+        });
+    }
+    else if (age > ttl) {
+        // Cookie has become stale and server session will have been removed;
+        // redirect to session-timeout
+        log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
+        const language = (_a = req.session.language) !== null && _a !== void 0 ? _a : 'en';
+        req.session.destroy((err) => {
+            if (err) {
+                next(err);
+            }
+            else {
+                removeCookie(res);
+                const params = new URLSearchParams({
+                    referrer: req.originalUrl,
+                    lang: language,
+                });
+                res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
+            }
+        });
+    }
+    else {
+        // Touch cookie and continue
+        touchCookie(res);
+        next();
+    }
+};
 // 3 middleware:
 // - set the session cookie
 // - parse request cookies
@@ -44,8 +95,15 @@ function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl,
     const ttlGrace = 1800; // user will see session-timeout if session expires within 30mins
     const touchCookieName = `${name}.t`;
     const touchCookieOptions = Object.assign(Object.assign({}, commonCookieOptions), { maxAge: (ttl + ttlGrace) * 1000, signed: true });
+    const getCookie = (req) => {
+        var _a;
+        // Disabled eslint as `touchCookieName` is a constant, known value
+        /* eslint-disable-next-line security/detect-object-injection */
+        const lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
+        return Number.isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001);
+    };
     const touchCookie = (res) => {
-        // Touch cookie expiry is 3a short period after the session ttl. This gives
+        // Touch cookie expiry is a short period after the session ttl. This gives
         // a small period of time where a user will see the session-timeout message,
         // which is important to avoid the confusion of simply being redirected back
         // to the start of their journey.
@@ -64,58 +122,7 @@ function sessionMiddleware({ cookieParserMiddleware, secret, name, secure, ttl,
             store,
         }),
         cookieParserMiddleware,
-        (req, res, next) => {
-            var _a, _b;
-            let lastModified = Date.parse(String((_a = req.signedCookies[touchCookieName]) !== null && _a !== void 0 ? _a : '1970-01-01T00:00:00+0000'));
-            lastModified = Number.isNaN(lastModified) ? 0 : Math.floor(lastModified * 0.001);
-            const age = Math.floor(Date.now() * 0.001) - lastModified;
-            if (lastModified === 0) {
-                // New session, or grace period cookie no longer available after
-                // expiring; generate a new session, and create grace-period cookie.
-                // This will invalidate any CSRF tokens, so by letting the request POST
-                // requests through the user may see a 500 error response.
-                log.info('Session is new, or grace period has expired. Regenerating session.');
-                req.session.regenerate((err) => {
-                    if (err) {
-                        next(err);
-                    }
-                    else {
-                        touchCookie(res);
-                        if (req.method === 'POST') {
-                            log.info('The CSRF token for this POST request will now be invalid for this regenerated session. Redirecting to app mount point.');
-                            res.redirect(302, mountUrl);
-                        }
-                        else {
-                            next();
-                        }
-                    }
-                });
-            }
-            else if (age > ttl) {
-                // Cookie has become stale and server session will have been removed;
-                // redirect to session-timeout
-                log.info('Session has timed out within grace period. Destroying session and redirecting to timeout page.');
-                const language = (_b = req.session.language) !== null && _b !== void 0 ? _b : 'en';
-                req.session.destroy((err) => {
-                    if (err) {
-                        next(err);
-                    }
-                    else {
-                        removeCookie(res);
-                        const params = new URLSearchParams({
-                            referrer: req.originalUrl,
-                            lang: language,
-                        });
-                        res.redirect(302, `${mountUrl}session-timeout?${params.toString()}`);
-                    }
-                });
-            }
-            else {
-                // Touch cookie and continue
-                touchCookie(res);
-                next();
-            }
-        },
+        sessionExpiryMiddleware(mountUrl, ttl, getCookie, touchCookie, removeCookie),
     ];
 }
 exports.default = sessionMiddleware;

package/dist/middleware/skip-waypoint.js

@@ -26,8 +26,8 @@ exports.default = ({ waypoint, mountUrl, }) => [
         const redirectUrl = (0, waypoint_url_js_1.default)({
             mountUrl,
             waypoint: skipTo,
-            edit: req.editMode,
-            editOrigin: req.editOriginUrl,
+            edit: req.casa.editMode,
+            editOrigin: req.casa.editOrigin,
             journeyContext: req.casa.journeyContext,
         });
         log.debug(`Will redirect to "${redirectUrl}" after skipping "${waypoint}"`);

package/dist/middleware/validate-fields.js

@@ -21,6 +21,8 @@ exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
         var _a, _b;
         let errors = [];
         for (let i = 0, l = fields.length; i < l; i++) {
+            /* eslint-disable security/detect-object-injection */
+            // Dynamic object keys are only used on known entities (fields, waypoint)
             const field = fields[i];
             const fieldName = field.name;
             const fieldValue = (_b = (_a = req.casa.journeyContext.data) === null || _a === void 0 ? void 0 : _a[waypoint]) === null || _b === void 0 ? void 0 : _b[fieldName];
@@ -30,12 +32,11 @@ exports.default = ({ waypoint, fields = [], mountUrl, plan, }) => [
                 waypoint,
                 journeyContext: req.casa.journeyContext,
             };
-            if (field.testConditions(context)) {
-                errors = [
-                    ...errors,
-                    ...field.runValidators(fieldValue, context),
-                ];
-            }
+            /* eslint-enable security/detect-object-injection */
+            errors = [
+                ...errors,
+                ...field.runValidators(fieldValue, context),
+            ];
         }
         // Validation passed with no errors
         if (!errors.length) {

package/dist/routes/ancillary.js

@@ -15,8 +15,6 @@ function ancillaryRouter({ sessionTtl, }) {
     // Router
     const router = new MutableRouter_js_1.default();
     // Session timeout
-    // TODO: add a `ancillary.presessiontimeout` hook here? Might be useful for
-    // those who way to enhance the timeout route, rather than replacing it completely
     router.all('/session-timeout', (req, res) => {
         res.render('casa/session-timeout.njk', {
             sessionTtl: Math.floor(sessionTtl / 60),

package/dist/routes/dirname.cjs

@@ -1 +1 @@
-module.exports = __dirname;
+module.exports = __dirname;

package/dist/routes/journey.js

@@ -14,16 +14,13 @@ const progress_journey_js_1 = __importDefault(require("../middleware/progress-jo
 const waypoint_url_js_1 = __importDefault(require("../lib/waypoint-url.js"));
 const logger_js_1 = __importDefault(require("../lib/logger.js"));
 const utils_js_1 = require("../lib/utils.js");
-const log = (0, logger_js_1.default)('router:journey');
+const log = (0, logger_js_1.default)('routes:journey');
 const renderMiddlewareFactory = (view, contextFactory) => [
     (req, res, next) => {
         res.render(view, Object.assign({ 
             // Common template variables for both GET and POST requests
-            inEditMode: req.casa.editMode, editOriginUrl: req.casa.editOrigin, 
-            // editSearchParams: req.editSearchParams,
-            activeContextId: req.casa.journeyContext.identity.id }, contextFactory(req)), (err, templateString) => {
+            inEditMode: req.casa.editMode, editOriginUrl: req.casa.editOrigin, activeContextId: req.casa.journeyContext.identity.id }, contextFactory(req)), (err, templateString) => {
             if (err) {
-                // logger.error(err);
                 next(err);
             }
             else {
@@ -110,9 +107,11 @@ function journeyRouter({ globalHooks, pages, plan, csrfMiddleware, mountUrl, })
             // errors in that format.
             // Where there are multiple errors against a particular field, only the
             // first one is shown.
+            // Disabling security/detect-object-injection rule because both `errors`
+            // and the `k` property are known entities
             const govukErrors = Object.keys(errors).map((k) => ({
                 text: req.t(errors[k][0].summary, errors[k][0].variables),
-                href: errors[k][0].fieldHref,
+                href: errors[k][0].fieldHref, /* eslint-disable-line security/detect-object-injection */
             }));
             return {
                 formUrl,

package/package.json

@@ -1,7 +1,11 @@
 {
   "name": "@dwp/govuk-casa",
-  "version": "8.0.0-beta2",
+  "version": "8.0.3",
   "description": "A framework for building GOVUK Collect-And-Submit-Applications",
+  "repository": {
+    "type": "git",
+    "url": "git@github.com:dwp/govuk-casa.git"
+  },
   "main": "dist/casa.js",
   "module": "dist/mjs/casa.js",
   "exports": {
@@ -18,18 +22,19 @@
     "node": ">=14.17.2"
   },
   "scripts": {
-    "pipeline": "npm test && npm run test:e2e && npm run lint",
-    "test": "mocha './tests/**/*.test.js'",
+    "pipeline": "npm run coverage && npm run lint",
+    "test:unit": "mocha './tests/**/*.test.js'",
     "test:e2e": "spiderplan --worker-init ./tests/e2e/worker-init.js --language en ./tests/e2e/personas/**/*.yaml",
-    "test:combined": "npm test; npm run test:e2e",
+    "test": "npm run test:unit && npm run test:e2e",
     "lint": "eslint .",
-    "coverage": "c8 npm run test:combined",
+    "coverage": "c8 npm test",
     "build": "npm run build:prepare && npm run build:sources && npm run build:css-assets",
     "build:prepare": "rm -rf dist/* && mkdir -p dist/assets/js/ && mkdir -p dist/assets/css/",
     "build:sources": "tsc -p tsconfig-cjs.json && ./scripts/fixup.sh",
     "build:css-assets": "node scripts/compile-sass.js",
     "prepare": "npm run build",
-    "upgrade-deps": "OD=$(npm outdated --long --parseable); echo \"$OD\" | grep ':devDependencies:' | awk -F: '{ print $4 }' | xargs npm i -DE; echo \"$OD\" | grep ':dependencies:' | awk -F: '{ print $4 }' | xargs npm i -E"
+    "upgrade-deps": "OD=$(npm outdated --long --parseable); echo \"$OD\" | grep ':devDependencies:' | awk -F: '{ print $4 }' | xargs npm i -DE; echo \"$OD\" | grep ':dependencies:' | awk -F: '{ print $4 }' | xargs npm i -E",
+    "standard-version": "node scripts/standard-version.js"
   },
   "keywords": [],
   "author": "DWP Digital",
@@ -40,46 +45,48 @@
     "csurf": "1.11.0",
     "debug": "4.3.3",
     "deepmerge": "4.2.2",
-    "express": "4.17.1",
+    "express": "4.17.2",
     "express-session": "1.17.2",
-    "govuk-frontend": "3.14.0",
+    "govuk-frontend": "4.0.0",
     "graphlib": "2.1.8",
-    "helmet": "4.6.0",
-    "i18next": "21.6.0",
-    "i18next-http-middleware": "3.1.4",
+    "helmet": "5.0.2",
+    "i18next": "21.6.10",
+    "i18next-http-middleware": "3.1.5",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
-    "luxon": "2.1.1",
+    "luxon": "2.3.0",
     "nunjucks": "3.2.3",
     "uuid": "8.3.2",
-    "validator": "^13.7.0"
+    "validator": "13.7.0"
   },
   "devDependencies": {
-    "@babel/core": "7.16.0",
-    "@babel/eslint-parser": "7.16.3",
-    "@babel/preset-env": "7.16.4",
-    "@commitlint/config-conventional": "15.0.0",
-    "@dwp/casa-spiderplan": "2.0.0",
+    "@babel/core": "7.16.12",
+    "@babel/eslint-parser": "7.16.5",
+    "@babel/preset-env": "7.16.11",
+    "@commitlint/config-conventional": "16.0.0",
+    "@dwp/casa-spiderplan": "2.3.0",
     "@dwp/casa-spiderplan-a11y-plugin": "0.1.3",
     "@dwp/casa-spiderplan-zap-plugin": "0.1.1",
-    "@dwp/eslint-config-base": "5.0.1",
+    "@dwp/eslint-config-base": "6.0.0",
     "@types/express": "4.17.13",
-    "@types/node": "16.11.12",
-    "@types/nunjucks": "3.2.0",
+    "@types/node": "17.0.12",
+    "@types/nunjucks": "3.2.1",
     "babel-eslint": "10.1.0",
-    "c8": "7.10.0",
-    "chai": "4.3.4",
-    "commitlint": "15.0.0",
-    "eslint": "7.32.0",
+    "c8": "7.11.0",
+    "chai": "4.3.6",
+    "commitlint": "16.1.0",
+    "eslint": "8.7.0",
     "eslint-plugin-no-unsafe-regex": "1.0.0",
+    "eslint-plugin-security": "1.4.0",
     "eslint-plugin-sonarjs": "0.11.0",
-    "fast-check": "2.20.0",
+    "fast-check": "2.21.0",
     "husky": "7.0.4",
-    "mocha": "9.1.3",
-    "sass": "1.44.0",
+    "mocha": "9.2.0",
+    "sass": "1.49.0",
     "sinon": "12.0.1",
     "sinon-chai": "3.7.0",
-    "supertest": "6.1.6",
-    "typescript": "4.5.3"
+    "standard-version": "9.3.2",
+    "supertest": "6.2.2",
+    "typescript": "4.5.5"
   }
 }