@dwp/govuk-casa 8.4.0 → 8.5.2

package/dist/lib/nunjucks-filters.js

@@ -54,12 +54,17 @@ exports.includes = includes;
  *   object - {dd:'', mm:'', yyyy:''}
  *
  * @memberof NunjucksFilters
- * @param  {object} date Date (see supported formats above)
- * @param  {object} config Holds locale
+ * @param  {object} date Date
+ * @param  {string} date.dd Day
+ * @param  {string} date.mm Month
+ * @param  {string} date.yyyy Year
+ * @param  {object} [config] Options
+ * @param  {string} [config.locale] Locale (default 'en')
+ * @param  {string} [config.format] Format (default 'd MMMM yyyy')
  * @returns {string} Formatted date
  */
 function formatDateObject(date, config = {}) {
-    const { locale = 'en' } = config;
+    const { locale = 'en', format = 'd MMMM yyyy' } = config;
     if (Object.prototype.toString.call(date) === '[object Object]'
         && 'yyyy' in date
         && 'mm' in date
@@ -68,7 +73,7 @@ function formatDateObject(date, config = {}) {
             year: Math.max(0, parseInt(date.yyyy, 10)),
             month: Math.max(0, parseInt(date.mm, 10)),
             day: Math.max(1, parseInt(date.dd, 10)),
-        }).setLocale(locale).toFormat('d MMMM yyyy');
+        }).setLocale(locale).toFormat(format);
     }
     return 'INVALID DATE OBJECT';
 }

package/dist/middleware/post.js

@@ -26,31 +26,31 @@ function postMiddleware() {
             // CSRF token is invalid in some way
             if ((err === null || err === void 0 ? void 0 : err.code) === 'EBADCSRFTOKEN') {
                 log.info('CSRF validation has failed. This may be caused by the user submitting a stale form from a previous session [EBADCSRFTOKEN]');
-                return res.status(403).render(TEMPLATE, { errorCode: 'bad_csrf_token' });
+                return res.status(403).render(TEMPLATE, { errorCode: 'bad_csrf_token', error: err });
             }
             // Body parsing verification check failed
             if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.verify.failed') {
                 log.info('Body parser verification has failed. This has been caused by the user submitting a payload containing invalid data [entity.verify.failed]');
-                return res.status(403).render(TEMPLATE, { errorCode: 'invalid_payload' });
+                return res.status(403).render(TEMPLATE, { errorCode: 'invalid_payload', error: err });
             }
             // Too many parameters submitted
             if ((err === null || err === void 0 ? void 0 : err.type) === 'parameters.too.many') {
                 log.info('The request contains more parameters than is currently allowed [parameters.too.many]');
-                return res.status(413).render(TEMPLATE, { errorCode: 'parameter_limit_exceeded' });
+                return res.status(413).render(TEMPLATE, { errorCode: 'parameter_limit_exceeded', error: err });
             }
             // Overall payload too large
             if ((err === null || err === void 0 ? void 0 : err.type) === 'entity.too.large') {
                 log.info(`The request payload is too large. Received ${err.length}b with a maximum of ${err.limit}b [parameters.too.many]`);
-                return res.status(413).render(TEMPLATE, { errorCode: 'payload_size_exceeded' });
+                return res.status(413).render(TEMPLATE, { errorCode: 'payload_size_exceeded', error: err });
             }
             // Unaccept request method
             if ((err === null || err === void 0 ? void 0 : err.code) === 'unaccepted_request_method') {
                 log.info(err.message);
-                return res.status(400).render(TEMPLATE, { errorCode: 'unaccepted_request_method' });
+                return res.status(400).render(TEMPLATE, { errorCode: 'unaccepted_request_method', error: err });
             }
             // Unknown error
             log.error(`Unknown error: ${err.message}; stacktrace: ${err.stack}`);
-            return res.status(200).render(TEMPLATE);
+            return res.status(200).render(TEMPLATE, { error: err });
         },
     ];
 }

package/dist/middleware/pre.js

@@ -5,13 +5,29 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
 Object.defineProperty(exports, "__esModule", { value: true });
 const crypto_1 = require("crypto");
 const helmet_1 = __importDefault(require("helmet"));
-const GA_DOMAIN = '*.google-analytics.com';
-const GA_ANALYTICS_DOMAIN = '*.analytics.google.com';
-const GTM_DOMAIN = 'www.googletagmanager.com';
 /**
  * @access private
  * @typedef {import('../casa').HelmetConfigurator} HelmetConfigurator
  */
+const GA_DOMAIN = '*.google-analytics.com';
+const GA_ANALYTICS_DOMAIN = '*.analytics.google.com';
+const GTM_DOMAIN = '*.googletagmanager.com';
+const GTM_PREVIEW_DOMAIN = 'https://tagmanager.google.com';
+/**
+ * Extracts the CSP nonce used in every template, and makes it available as a
+ * nonce value in the CSP header.
+ *
+ * IMPORTANT: Do not rename this function as it _might_ be used in consumer code
+ * to identify this function specifically, most likely to remove it from CSP
+ * headers for custom purposes.
+ *
+ * @param {import('express').Request} req Request
+ * @param {import('express').Response} res Response
+ * @returns {string} nonce value suitable for use in CSP header
+ */
+function casaCspNonce(req, res) {
+    return `'nonce-${res.locals.cspNonce}'`;
+}
 /**
  * Pre middleware.
  *
@@ -55,14 +71,14 @@ exports.default = ({ helmetConfigurator = (config) => (config), } = {}) => [
             useDefaults: true,
             directives: {
                 'default-src': ["'none'"],
-                'script-src': ["'self'", GA_DOMAIN, GTM_DOMAIN, (req, res) => `'nonce-${res.locals.cspNonce}'`],
-                'img-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
-                'connect-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN],
+                'script-src': ["'self'", GA_DOMAIN, GTM_DOMAIN, GTM_PREVIEW_DOMAIN, casaCspNonce],
+                'img-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN, GTM_DOMAIN, 'https://ssl.gstatic.com', 'https://www.gstatic.com'],
+                'connect-src': ["'self'", GA_DOMAIN, GA_ANALYTICS_DOMAIN, GTM_DOMAIN],
                 'frame-src': ["'self'", GTM_DOMAIN],
                 'frame-ancestors': ["'self'"],
                 'form-action': ["'self'"],
-                'style-src': ["'self'", (req, res) => `'nonce-${res.locals.cspNonce}'`],
-                'font-src': ["'self'"],
+                'style-src': ["'self'", 'https://fonts.googleapis.com', GTM_PREVIEW_DOMAIN, casaCspNonce],
+                'font-src': ["'self'", 'data:', 'https://fonts.gstatic.com'],
             },
         },
         // // Require referrer to aid navigation

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dwp/govuk-casa",
-  "version": "8.4.0",
+  "version": "8.5.2",
   "description": "A framework for building GOVUK Collect-And-Submit-Applications",
   "repository": {
     "type": "git",
@@ -46,12 +46,12 @@
     "csurf": "1.11.0",
     "debug": "4.3.4",
     "deepmerge": "4.2.2",
-    "express": "4.18.1",
+    "express": "4.18.2",
     "express-session": "1.17.3",
-    "govuk-frontend": "4.2.0",
+    "govuk-frontend": "4.3.1",
     "graphlib": "2.1.8",
-    "helmet": "5.1.0",
-    "i18next": "21.8.14",
+    "helmet": "5.1.1",
+    "i18next": "21.10.0",
     "i18next-http-middleware": "3.2.1",
     "js-yaml": "4.1.0",
     "lodash": "4.17.21",
@@ -62,38 +62,38 @@
     "validator": "13.7.0"
   },
   "devDependencies": {
-    "@babel/core": "7.18.9",
-    "@babel/eslint-parser": "7.18.9",
-    "@babel/preset-env": "7.18.9",
-    "@ckeditor/jsdoc-plugins": "30.3.2",
-    "@commitlint/config-conventional": "17.0.3",
+    "@babel/core": "7.19.6",
+    "@babel/eslint-parser": "7.19.1",
+    "@babel/preset-env": "7.19.4",
+    "@ckeditor/jsdoc-plugins": "30.5.0",
+    "@commitlint/config-conventional": "17.1.0",
     "@dwp/casa-spiderplan": "2.4.1",
     "@dwp/casa-spiderplan-a11y-plugin": "0.1.4",
     "@dwp/casa-spiderplan-zap-plugin": "0.1.1",
     "@dwp/eslint-config-base": "6.0.0",
-    "@types/express": "4.17.13",
-    "@types/node": "18.0.0",
+    "@types/express": "4.17.14",
+    "@types/node": "18.11.8",
     "@types/nunjucks": "3.2.1",
     "babel-eslint": "10.1.0",
-    "c8": "7.11.3",
+    "c8": "7.12.0",
     "chai": "4.3.6",
     "cheerio": "1.0.0-rc.12",
-    "commitlint": "17.0.3",
+    "commitlint": "17.1.2",
     "docdash": "1.2.0",
-    "eslint": "8.20.0",
+    "eslint": "8.26.0",
     "eslint-plugin-no-unsafe-regex": "1.0.0",
     "eslint-plugin-security": "1.5.0",
-    "eslint-plugin-sonarjs": "0.13.0",
-    "fast-check": "3.0.1",
+    "eslint-plugin-sonarjs": "0.16.0",
+    "fast-check": "3.3.0",
     "husky": "8.0.1",
-    "jsdoc": "3.6.10",
+    "jsdoc": "3.6.11",
     "jsdoc-tsimport-plugin": "1.0.5",
-    "mocha": "10.0.0",
-    "sass": "1.53.0",
-    "sinon": "14.0.0",
+    "mocha": "10.1.0",
+    "sass": "1.55.0",
+    "sinon": "14.0.1",
     "sinon-chai": "3.7.0",
     "standard-version": "9.5.0",
-    "supertest": "6.2.4",
-    "typescript": "4.7.4"
+    "supertest": "6.3.1",
+    "typescript": "4.8.4"
   }
 }