@elliemae/pui-cli 8.41.2 → 8.41.4

package/dist/cjs/server/csp.js

@@ -69,11 +69,6 @@ const getScriptSrc = () => {
   const scriptSrc = [source, "'strict-dynamic'"];
   return true ? scriptSrc.concat(["'unsafe-eval'"]) : scriptSrc;
 };
-const getStyleSrc = () => {
-  const source = (req, res) => `'nonce-${res.locals.cspNonce}'`;
-  const scriptSrc = [source, "'strict-dynamic'"];
-  return true ? scriptSrc.concat(["'unsafe-inline'"]) : scriptSrc;
-};
 const csp = (app) => {
   app.use((req, res, next) => {
     res.locals.cspNonce = import_crypto.default.randomBytes(32).toString("base64");
@@ -89,7 +84,6 @@ const csp = (app) => {
           frameAncestors: sources,
           objectSrc: ["'none'"],
           scriptSrc: getScriptSrc(),
-          styleSrc: getStyleSrc(),
           upgradeInsecureRequests: [],
           reportTo: CSP_REPORT_URI
         },

package/dist/cjs/webpack/interceptor-middleware.js

@@ -0,0 +1,127 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var interceptor_middleware_exports = {};
+__export(interceptor_middleware_exports, {
+  addCSPNonceMiddleware: () => addCSPNonceMiddleware,
+  interceptorMiddleware: () => interceptorMiddleware
+});
+module.exports = __toCommonJS(interceptor_middleware_exports);
+const VALID_PARAMS = ["isInterceptable", "intercept", "afterSend"];
+const validateParams = (methods) => {
+  Object.keys(methods).forEach((k) => {
+    if (VALID_PARAMS.indexOf(k) < 0) {
+      throw new Error(`${k} isn't a valid param (${VALID_PARAMS.join(", ")})`);
+    }
+  });
+  if (!("isInterceptable" in methods)) {
+    throw new Error("isInterceptable is a required param (function)");
+  }
+};
+const interceptorMiddleware = (fn) => (req, res, next) => {
+  const methods = fn(req, res);
+  validateParams(methods);
+  const originalEnd = res.end;
+  const originalWrite = res.write;
+  const chunks = [];
+  let isIntercepting;
+  let isFirstWrite = true;
+  function intercept(rawChunk, encoding) {
+    if (isFirstWrite) {
+      isFirstWrite = false;
+      isIntercepting = methods.isInterceptable();
+    }
+    if (isIntercepting) {
+      if (rawChunk) {
+        let tempChunk = rawChunk;
+        if (rawChunk !== null && !Buffer.isBuffer(tempChunk)) {
+          if (!encoding) {
+            tempChunk = Buffer.from(rawChunk);
+          } else {
+            tempChunk = Buffer.from(
+              rawChunk,
+              encoding
+            );
+          }
+        }
+        chunks.push(tempChunk);
+      }
+    }
+    return isIntercepting;
+  }
+  const newResWrite = (...args) => {
+    if (!intercept(args[0], args[1])) {
+      return originalWrite.apply(res, args);
+    }
+    return true;
+  };
+  res.write = newResWrite;
+  const afterSend = (oldBody, newBody) => {
+    if (typeof methods.afterSend === "function") {
+      process.nextTick(() => {
+        methods.afterSend?.(oldBody, newBody);
+      });
+    }
+  };
+  const newResEnd = (...args) => {
+    if (intercept(args[0], args[1])) {
+      isIntercepting = false;
+      const oldBody = Buffer.concat(args[0]).toString(
+        "utf-8"
+      );
+      if (methods.intercept) {
+        if (typeof methods.intercept !== "function") {
+          throw new Error(
+            "`send` must be a function with the body to be sent as the only param"
+          );
+        }
+        res.removeHeader("Content-Length");
+        methods.intercept(oldBody, (newBody) => {
+          args[0] = newBody;
+          originalEnd.apply(res, args);
+          afterSend(oldBody, newBody);
+        });
+      } else {
+        afterSend(oldBody, oldBody);
+        originalEnd.apply(res, args);
+      }
+    } else {
+      originalEnd.apply(res, args);
+    }
+  };
+  res.end = newResEnd;
+  next();
+};
+const addCSPNonceMiddleware = (middlewares) => {
+  const index = middlewares.findIndex(
+    (middleware) => middleware.name === "webpack-dev-middleware"
+  );
+  middlewares.splice(index, 0, {
+    name: "csp-nonce-middleware",
+    middleware: interceptorMiddleware((req, res) => ({
+      // Only HTML responses will be intercepted
+      isInterceptable() {
+        return /text\/html/.test(res.get("Content-Type") ?? "");
+      },
+      // Appends a paragraph at the end of the response body
+      intercept(body, send) {
+        send(body.replace(/__CSP_NONCE__/g, res.locals.cspNonce));
+      }
+    }))
+  });
+};

package/dist/cjs/webpack/webpack.dev.babel.js

@@ -100,7 +100,7 @@ const devConfig = {
   // Add development plugins
   plugins: [
     new import_html_webpack_plugin.default({
-      inject: !(0, import_helpers.isAppLoaderEnabled)(),
+      inject: !(0, import_helpers.isAppLoaderEnabled)() && process.env.CSP !== "true",
       // Inject all files that are generated by webpack, e.g. bundle.js
       template: !(0, import_helpers.isAppLoaderEnabled)() ? "app/index.html" : "app/index-app-loader.html",
       emui: {

package/dist/esm/server/csp.js

@@ -35,11 +35,6 @@ const getScriptSrc = () => {
   const scriptSrc = [source, "'strict-dynamic'"];
   return true ? scriptSrc.concat(["'unsafe-eval'"]) : scriptSrc;
 };
-const getStyleSrc = () => {
-  const source = (req, res) => `'nonce-${res.locals.cspNonce}'`;
-  const scriptSrc = [source, "'strict-dynamic'"];
-  return true ? scriptSrc.concat(["'unsafe-inline'"]) : scriptSrc;
-};
 const csp = (app) => {
   app.use((req, res, next) => {
     res.locals.cspNonce = crypto.randomBytes(32).toString("base64");
@@ -55,7 +50,6 @@ const csp = (app) => {
           frameAncestors: sources,
           objectSrc: ["'none'"],
           scriptSrc: getScriptSrc(),
-          styleSrc: getStyleSrc(),
           upgradeInsecureRequests: [],
           reportTo: CSP_REPORT_URI
         },

package/dist/esm/webpack/interceptor-middleware.js

@@ -0,0 +1,107 @@
+const VALID_PARAMS = ["isInterceptable", "intercept", "afterSend"];
+const validateParams = (methods) => {
+  Object.keys(methods).forEach((k) => {
+    if (VALID_PARAMS.indexOf(k) < 0) {
+      throw new Error(`${k} isn't a valid param (${VALID_PARAMS.join(", ")})`);
+    }
+  });
+  if (!("isInterceptable" in methods)) {
+    throw new Error("isInterceptable is a required param (function)");
+  }
+};
+const interceptorMiddleware = (fn) => (req, res, next) => {
+  const methods = fn(req, res);
+  validateParams(methods);
+  const originalEnd = res.end;
+  const originalWrite = res.write;
+  const chunks = [];
+  let isIntercepting;
+  let isFirstWrite = true;
+  function intercept(rawChunk, encoding) {
+    if (isFirstWrite) {
+      isFirstWrite = false;
+      isIntercepting = methods.isInterceptable();
+    }
+    if (isIntercepting) {
+      if (rawChunk) {
+        let tempChunk = rawChunk;
+        if (rawChunk !== null && !Buffer.isBuffer(tempChunk)) {
+          if (!encoding) {
+            tempChunk = Buffer.from(rawChunk);
+          } else {
+            tempChunk = Buffer.from(
+              rawChunk,
+              encoding
+            );
+          }
+        }
+        chunks.push(tempChunk);
+      }
+    }
+    return isIntercepting;
+  }
+  const newResWrite = (...args) => {
+    if (!intercept(args[0], args[1])) {
+      return originalWrite.apply(res, args);
+    }
+    return true;
+  };
+  res.write = newResWrite;
+  const afterSend = (oldBody, newBody) => {
+    if (typeof methods.afterSend === "function") {
+      process.nextTick(() => {
+        methods.afterSend?.(oldBody, newBody);
+      });
+    }
+  };
+  const newResEnd = (...args) => {
+    if (intercept(args[0], args[1])) {
+      isIntercepting = false;
+      const oldBody = Buffer.concat(args[0]).toString(
+        "utf-8"
+      );
+      if (methods.intercept) {
+        if (typeof methods.intercept !== "function") {
+          throw new Error(
+            "`send` must be a function with the body to be sent as the only param"
+          );
+        }
+        res.removeHeader("Content-Length");
+        methods.intercept(oldBody, (newBody) => {
+          args[0] = newBody;
+          originalEnd.apply(res, args);
+          afterSend(oldBody, newBody);
+        });
+      } else {
+        afterSend(oldBody, oldBody);
+        originalEnd.apply(res, args);
+      }
+    } else {
+      originalEnd.apply(res, args);
+    }
+  };
+  res.end = newResEnd;
+  next();
+};
+const addCSPNonceMiddleware = (middlewares) => {
+  const index = middlewares.findIndex(
+    (middleware) => middleware.name === "webpack-dev-middleware"
+  );
+  middlewares.splice(index, 0, {
+    name: "csp-nonce-middleware",
+    middleware: interceptorMiddleware((req, res) => ({
+      // Only HTML responses will be intercepted
+      isInterceptable() {
+        return /text\/html/.test(res.get("Content-Type") ?? "");
+      },
+      // Appends a paragraph at the end of the response body
+      intercept(body, send) {
+        send(body.replace(/__CSP_NONCE__/g, res.locals.cspNonce));
+      }
+    }))
+  });
+};
+export {
+  addCSPNonceMiddleware,
+  interceptorMiddleware
+};

package/dist/esm/webpack/webpack.dev.babel.js

@@ -70,7 +70,7 @@ const devConfig = {
   // Add development plugins
   plugins: [
     new HtmlWebpackPlugin({
-      inject: !isAppLoaderEnabled(),
+      inject: !isAppLoaderEnabled() && process.env.CSP !== "true",
       // Inject all files that are generated by webpack, e.g. bundle.js
       template: !isAppLoaderEnabled() ? "app/index.html" : "app/index-app-loader.html",
       emui: {

package/dist/types/lib/webpack/interceptor-middleware.d.ts

@@ -0,0 +1,10 @@
+import { Request, Response } from 'express';
+import { Middleware } from 'webpack-dev-server';
+type ReplacerFunction = (req: Request, res: Response) => {
+    isInterceptable: () => boolean;
+    intercept: (body: string, send: (body: string) => void) => void;
+    afterSend?: (oldBody: string, newBody: string) => void;
+};
+export declare const interceptorMiddleware: (fn: ReplacerFunction) => (req: Request, res: Response, next: () => void) => void;
+export declare const addCSPNonceMiddleware: (middlewares: Middleware[]) => void;
+export {};