@elliemae/pui-cli 8.41.1 → 8.41.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (6) hide show
  1. package/dist/cjs/server/csp.js +10 -2
  2. package/dist/cjs/webpack/webpack.prod.babel.js +1 -1
  3. package/dist/esm/server/csp.js +10 -2
  4. package/dist/esm/webpack/webpack.prod.babel.js +1 -1
  5. package/dist/types/tsconfig.tsbuildinfo +1 -1
  6. package/package.json +1 -1
package/dist/cjs/server/csp.js CHANGED
@@ -66,22 +66,30 @@ const sendFileWithCSPNonce = ({
66
66
  };
67
67
  const getScriptSrc = () => {
68
68
  const source = (req, res) => `'nonce-${res.locals.cspNonce}'`;
69
- const scriptSrc = [source, "strict-dynamic"];
69
+ const scriptSrc = [source, "'strict-dynamic'"];
70
70
  return true ? scriptSrc.concat(["'unsafe-eval'"]) : scriptSrc;
71
71
  };
72
+ const getStyleSrc = () => {
73
+ const source = (req, res) => `'nonce-${res.locals.cspNonce}'`;
74
+ const scriptSrc = [source, "'strict-dynamic'"];
75
+ return true ? scriptSrc.concat(["'unsafe-inline'"]) : scriptSrc;
76
+ };
72
77
  const csp = (app) => {
73
78
  app.use((req, res, next) => {
74
- res.locals.cspNonce = import_crypto.default.randomBytes(32).toString("hex");
79
+ res.locals.cspNonce = import_crypto.default.randomBytes(32).toString("base64");
75
80
  next();
76
81
  });
77
82
  app.use(
78
83
  (0, import_helmet.default)({
79
84
  contentSecurityPolicy: {
85
+ useDefaults: false,
80
86
  directives: {
87
+ defaultSrc: import_helmet.default.contentSecurityPolicy.dangerouslyDisableDefaultSrc,
81
88
  baseUri: ["'none'"],
82
89
  frameAncestors: sources,
83
90
  objectSrc: ["'none'"],
84
91
  scriptSrc: getScriptSrc(),
92
+ styleSrc: getStyleSrc(),
85
93
  upgradeInsecureRequests: [],
86
94
  reportTo: CSP_REPORT_URI
87
95
  },
package/dist/cjs/webpack/webpack.prod.babel.js CHANGED
@@ -115,7 +115,7 @@ const {
115
115
  basePath
116
116
  } = (0, import_helpers.getPaths)();
117
117
  const htmlWebpackPlugin = new import_html_webpack_plugin.default({
118
- inject: !(0, import_helpers.isAppLoaderEnabled)(),
118
+ inject: !(0, import_helpers.isAppLoaderEnabled)() && process.env.CSP !== "true",
119
119
  template: !(0, import_helpers.isAppLoaderEnabled)() ? "app/index.html" : "app/index-app-loader.html",
120
120
  minify: {
121
121
  removeComments: true,
package/dist/esm/server/csp.js CHANGED
@@ -32,22 +32,30 @@ const sendFileWithCSPNonce = ({
32
32
  };
33
33
  const getScriptSrc = () => {
34
34
  const source = (req, res) => `'nonce-${res.locals.cspNonce}'`;
35
- const scriptSrc = [source, "strict-dynamic"];
35
+ const scriptSrc = [source, "'strict-dynamic'"];
36
36
  return true ? scriptSrc.concat(["'unsafe-eval'"]) : scriptSrc;
37
37
  };
38
+ const getStyleSrc = () => {
39
+ const source = (req, res) => `'nonce-${res.locals.cspNonce}'`;
40
+ const scriptSrc = [source, "'strict-dynamic'"];
41
+ return true ? scriptSrc.concat(["'unsafe-inline'"]) : scriptSrc;
42
+ };
38
43
  const csp = (app) => {
39
44
  app.use((req, res, next) => {
40
- res.locals.cspNonce = crypto.randomBytes(32).toString("hex");
45
+ res.locals.cspNonce = crypto.randomBytes(32).toString("base64");
41
46
  next();
42
47
  });
43
48
  app.use(
44
49
  helmet({
45
50
  contentSecurityPolicy: {
51
+ useDefaults: false,
46
52
  directives: {
53
+ defaultSrc: helmet.contentSecurityPolicy.dangerouslyDisableDefaultSrc,
47
54
  baseUri: ["'none'"],
48
55
  frameAncestors: sources,
49
56
  objectSrc: ["'none'"],
50
57
  scriptSrc: getScriptSrc(),
58
+ styleSrc: getStyleSrc(),
51
59
  upgradeInsecureRequests: [],
52
60
  reportTo: CSP_REPORT_URI
53
61
  },
package/dist/esm/webpack/webpack.prod.babel.js CHANGED
@@ -87,7 +87,7 @@ const {
87
87
  basePath
88
88
  } = getPaths();
89
89
  const htmlWebpackPlugin = new HtmlWebpackPlugin({
90
- inject: !isAppLoaderEnabled(),
90
+ inject: !isAppLoaderEnabled() && process.env.CSP !== "true",
91
91
  template: !isAppLoaderEnabled() ? "app/index.html" : "app/index-app-loader.html",
92
92
  minify: {
93
93
  removeComments: true,