@elliemae/pui-cli 8.40.0 → 8.40.2

package/dist/cjs/commands/utils.js

@@ -153,6 +153,7 @@ const updateManifestWithVersionInfo = async (dest) => {
 };
 const updateRuntimeFile = async (src, dest, version) => {
   const latestJSFolder = "latest/js";
+  const latestCSSFolder = "latest/css";
   const pipe = (0, import_node_util.promisify)(import_node_stream.pipeline);
   const results = await (0, import_fast_glob.default)([
     import_node_path.default.join(src, "runtime~app.*.js").replace(/\\/g, "/")
@@ -162,17 +163,25 @@ const updateRuntimeFile = async (src, dest, version) => {
   const runtimeFileName = import_node_path.default.basename(runtimeFilePath);
   const destRuntimeFilePath = import_node_path.default.join(dest, runtimeFileName);
   const runtimeFileData = await (0, import_promises.readFile)(runtimeFilePath, "utf8");
-  if (runtimeFileData.includes(latestJSFolder)) {
+  if (runtimeFileData.includes(latestJSFolder) || runtimeFileData.includes(latestCSSFolder)) {
     await (0, import_promises.writeFile)(
       destRuntimeFilePath,
       runtimeFileData.replace(latestJSFolder, `${version}/js`)
     );
+    await (0, import_promises.writeFile)(
+      destRuntimeFilePath,
+      runtimeFileData.replace(latestCSSFolder, `${version}/css`)
+    );
     const sourceMapFile = `${runtimeFilePath}.map`;
     const sourcemap = await (0, import_promises.readFile)(sourceMapFile, "utf8");
     await (0, import_promises.writeFile)(
       `${destRuntimeFilePath}.map`,
       sourcemap.replace(latestJSFolder, `${version}/js`)
     );
+    await (0, import_promises.writeFile)(
+      `${destRuntimeFilePath}.map`,
+      sourcemap.replace(latestCSSFolder, `${version}/css`)
+    );
     const gzip = (0, import_node_zlib.createGzip)();
     let source = (0, import_node_fs.createReadStream)(destRuntimeFilePath);
     let destination = (0, import_node_fs.createWriteStream)(`${destRuntimeFilePath}.gz`);

package/dist/cjs/server/csp.js

@@ -36,11 +36,12 @@ var import_node_fs = __toESM(require("node:fs"), 1);
 var import_node_path = __toESM(require("node:path"), 1);
 var import_crypto = __toESM(require("crypto"), 1);
 var import_express = __toESM(require("express"), 1);
-var import_helmet_csp = __toESM(require("helmet-csp"), 1);
+var import_helmet = __toESM(require("helmet"), 1);
 const CSP_REPORT_URI = "/diagnostics/v1/csp";
 const sources = [
   "'self'",
   "http://localhost:*",
+  "https://localhost:*",
   "ws://localhost:*",
   "*.ice.com",
   "*.elliemae.io",
@@ -76,30 +77,44 @@ const getScriptSrc = () => {
 };
 const csp = (app) => {
   app.use((req, res, next) => {
-    res.locals.cspNonce = import_crypto.default.randomBytes(16).toString("hex");
+    res.locals.cspNonce = import_crypto.default.randomBytes(32).toString("hex");
     next();
   });
   app.use(
-    (0, import_helmet_csp.default)({
-      directives: {
-        defaultSrc: ["'self'"],
-        baseUri: ["'self'"],
-        blockAllMixedContent: [],
-        connectSrc: sources,
-        fontSrc: sources.concat(["data:"]),
-        frameAncestors: sources,
-        imgSrc: sources.concat(["data:"]),
-        objectSrc: ["'none'"],
-        scriptSrc: getScriptSrc(),
-        scriptSrcAttr: ["'none'"],
-        styleSrc: sources.concat(["'unsafe-inline'"]),
-        upgradeInsecureRequests: [],
-        reportUri: CSP_REPORT_URI
+    (0, import_helmet.default)({
+      contentSecurityPolicy: {
+        directives: {
+          baseUri: ["'self'"],
+          connectSrc: sources,
+          defaultSrc: ["'self'"],
+          fontSrc: sources.concat(["data:"]),
+          formAction: ["'self'"],
+          frameAncestors: sources,
+          frameSrc: sources,
+          imgSrc: sources.concat(["data:"]),
+          objectSrc: ["'none'"],
+          scriptSrc: getScriptSrc(),
+          scriptSrcAttr: ["'none'"],
+          styleSrc: sources.concat(["'unsafe-inline'"]),
+          workerSrc: sources,
+          upgradeInsecureRequests: [],
+          reportUri: CSP_REPORT_URI,
+          reportTo: CSP_REPORT_URI
+        },
+        reportOnly: true
       },
-      reportOnly: true
+      xFrameOptions: false,
+      xPermittedCrossDomainPolicies: false,
+      xDownloadOptions: false,
+      xXssProtection: false
+    })
+  );
+  app.use(
+    CSP_REPORT_URI,
+    import_express.default.json({
+      type: ["application/csp-report", "application/reports+json"]
     })
   );
-  app.use(CSP_REPORT_URI, import_express.default.json({ type: "application/csp-report" }));
   app.use(CSP_REPORT_URI, (req, res) => {
     console.log("CSP Violation: ", req.body);
     res.status(204).end();

package/dist/esm/commands/utils.js

@@ -122,6 +122,7 @@ const updateManifestWithVersionInfo = async (dest) => {
 };
 const updateRuntimeFile = async (src, dest, version) => {
   const latestJSFolder = "latest/js";
+  const latestCSSFolder = "latest/css";
   const pipe = promisify(pipeline);
   const results = await fg([
     path.join(src, "runtime~app.*.js").replace(/\\/g, "/")
@@ -131,17 +132,25 @@ const updateRuntimeFile = async (src, dest, version) => {
   const runtimeFileName = path.basename(runtimeFilePath);
   const destRuntimeFilePath = path.join(dest, runtimeFileName);
   const runtimeFileData = await readFile(runtimeFilePath, "utf8");
-  if (runtimeFileData.includes(latestJSFolder)) {
+  if (runtimeFileData.includes(latestJSFolder) || runtimeFileData.includes(latestCSSFolder)) {
     await writeFile(
       destRuntimeFilePath,
       runtimeFileData.replace(latestJSFolder, `${version}/js`)
     );
+    await writeFile(
+      destRuntimeFilePath,
+      runtimeFileData.replace(latestCSSFolder, `${version}/css`)
+    );
     const sourceMapFile = `${runtimeFilePath}.map`;
     const sourcemap = await readFile(sourceMapFile, "utf8");
     await writeFile(
       `${destRuntimeFilePath}.map`,
       sourcemap.replace(latestJSFolder, `${version}/js`)
     );
+    await writeFile(
+      `${destRuntimeFilePath}.map`,
+      sourcemap.replace(latestCSSFolder, `${version}/css`)
+    );
     const gzip = createGzip();
     let source = createReadStream(destRuntimeFilePath);
     let destination = createWriteStream(`${destRuntimeFilePath}.gz`);

package/dist/esm/server/csp.js

@@ -2,11 +2,12 @@ import fs from "node:fs";
 import path from "node:path";
 import crypto from "crypto";
 import express from "express";
-import cspPolicy from "helmet-csp";
+import helmet from "helmet";
 const CSP_REPORT_URI = "/diagnostics/v1/csp";
 const sources = [
   "'self'",
   "http://localhost:*",
+  "https://localhost:*",
   "ws://localhost:*",
   "*.ice.com",
   "*.elliemae.io",
@@ -42,30 +43,44 @@ const getScriptSrc = () => {
 };
 const csp = (app) => {
   app.use((req, res, next) => {
-    res.locals.cspNonce = crypto.randomBytes(16).toString("hex");
+    res.locals.cspNonce = crypto.randomBytes(32).toString("hex");
     next();
   });
   app.use(
-    cspPolicy({
-      directives: {
-        defaultSrc: ["'self'"],
-        baseUri: ["'self'"],
-        blockAllMixedContent: [],
-        connectSrc: sources,
-        fontSrc: sources.concat(["data:"]),
-        frameAncestors: sources,
-        imgSrc: sources.concat(["data:"]),
-        objectSrc: ["'none'"],
-        scriptSrc: getScriptSrc(),
-        scriptSrcAttr: ["'none'"],
-        styleSrc: sources.concat(["'unsafe-inline'"]),
-        upgradeInsecureRequests: [],
-        reportUri: CSP_REPORT_URI
+    helmet({
+      contentSecurityPolicy: {
+        directives: {
+          baseUri: ["'self'"],
+          connectSrc: sources,
+          defaultSrc: ["'self'"],
+          fontSrc: sources.concat(["data:"]),
+          formAction: ["'self'"],
+          frameAncestors: sources,
+          frameSrc: sources,
+          imgSrc: sources.concat(["data:"]),
+          objectSrc: ["'none'"],
+          scriptSrc: getScriptSrc(),
+          scriptSrcAttr: ["'none'"],
+          styleSrc: sources.concat(["'unsafe-inline'"]),
+          workerSrc: sources,
+          upgradeInsecureRequests: [],
+          reportUri: CSP_REPORT_URI,
+          reportTo: CSP_REPORT_URI
+        },
+        reportOnly: true
       },
-      reportOnly: true
+      xFrameOptions: false,
+      xPermittedCrossDomainPolicies: false,
+      xDownloadOptions: false,
+      xXssProtection: false
+    })
+  );
+  app.use(
+    CSP_REPORT_URI,
+    express.json({
+      type: ["application/csp-report", "application/reports+json"]
     })
   );
-  app.use(CSP_REPORT_URI, express.json({ type: "application/csp-report" }));
   app.use(CSP_REPORT_URI, (req, res) => {
     console.log("CSP Violation: ", req.body);
     res.status(204).end();