@forge/csp 1.8.0-next.1 → 1.9.0

package/CHANGELOG.md

@@ -1,5 +1,34 @@
 # @forge/csp
 
+## 1.9.0
+
+### Minor Changes
+
+- 1c196ff: Add support for external fetch client to reference remote
+
+### Patch Changes
+
+- 1dba082: Enabling new frame ancestors '_.atl-paas.net' and '_.atlassian.com'
+
+## 1.9.0-next.1
+
+### Minor Changes
+
+- 1c196ff: Add support for external fetch client to reference remote
+
+## 1.8.1-next.0
+
+### Patch Changes
+
+- 04e4152: Enabling new frame ancestors '_.atl-paas.net' and '_.atlassian.com'
+
+## 1.8.0
+
+### Minor Changes
+
+- d5f3fac: Remove deprecated method for handling CSP user config
+- f002362: Revert change for deprecated CSP
+
 ## 1.8.0-next.1
 
 ### Minor Changes

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAUvD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,iBAAiB;IAYlB,gBAAgB,uBACD,UAAU,OACzB,iBAAiB,gDAErB,MAAM,EAAE,CA4CT;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAUvD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,iBAAiB;IAalB,gBAAgB,uBACD,UAAU,OACzB,iBAAiB,gDAErB,MAAM,EAAE,CA4CT;CACH"}

package/out/csp/csp-injection-service.js

@@ -69,13 +69,14 @@ class CSPInjectionService {
     }
     getFrameAncestors(env) {
         if (env === 'prod')
-            return ['*.atlassian.net', 'bitbucket.org', '*.jira.com'];
+            return ['*.atlassian.net', 'bitbucket.org', '*.jira.com', '*.atlassian.com'];
         return [
             '*.jira-dev.com',
             'http://localhost:*',
             '*.devbucket.org',
             'https://staging.bb-inf.net',
-            'https://integration.bb-inf.net'
+            'https://integration.bb-inf.net',
+            '*.atl-paas.net'
         ];
     }
 }

package/out/csp/csp-processing-service.d.ts

@@ -1,11 +1,15 @@
 import type { Logger } from '@forge/cli-shared';
 import type { Permissions } from '@forge/manifest';
 import { ContentPermissions, CSPDetails, DocumentBody } from '../types';
+export declare class InvalidConnectSrc extends Error {
+    constructor();
+}
 export declare class CSPProcessingService {
     private readonly logger;
     constructor(logger: Pick<Logger, 'info'>);
     getCspDetails(body: DocumentBody, permissions: Permissions): CSPDetails;
     getInvalidCspPermissions(contentPermissions: ContentPermissions): string[];
+    private assertValidFetchClient;
     private mapExternalPermissionsToCsp;
     private getStyleSrc;
     private getScriptSrc;

package/out/csp/csp-processing-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-processing-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-processing-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAKnD,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,UAAU,CAAC;AAiB7F,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;IAElD,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,GAAG,UAAU;IAkBvE,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,MAAM,EAAE;IASjF,OAAO,CAAC,2BAA2B;IAcnC,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,oBAAoB;CAa7B"}
+{"version":3,"file":"csp-processing-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-processing-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAS,MAAM,iBAAiB,CAAC;AAK1D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,UAAU,CAAC;AAa7F,qBAAa,iBAAkB,SAAQ,KAAK;;CAI3C;AAMD,qBAAa,oBAAoB;IACnB,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;IAElD,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,GAAG,UAAU;IAkBvE,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,MAAM,EAAE;IASjF,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,2BAA2B;IAgBnC,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,YAAY;IAWpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,qBAAqB;IAW7B,OAAO,CAAC,UAAU;IAKlB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,oBAAoB;CAa7B"}

package/out/csp/csp-processing-service.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.CSPProcessingService = void 0;
+exports.CSPProcessingService = exports.InvalidConnectSrc = void 0;
 const tslib_1 = require("tslib");
 const cheerio_1 = tslib_1.__importDefault(require("cheerio"));
 const content_security_policy_parser_1 = tslib_1.__importDefault(require("content-security-policy-parser"));
@@ -12,6 +12,12 @@ const BASE_64_HASH_PATTERNS = [
     /^'sha384-[a-zA-Z0-9=+/]{64}'$/,
     /^'sha512-[a-zA-Z0-9=+/]{88}'$/
 ];
+class InvalidConnectSrc extends Error {
+    constructor() {
+        super('fetch.client should be an array of strings');
+    }
+}
+exports.InvalidConnectSrc = InvalidConnectSrc;
 class CSPProcessingService {
     constructor(logger) {
         this.logger = logger;
@@ -31,9 +37,19 @@ class CSPProcessingService {
         const invalidScripts = (_b = scripts === null || scripts === void 0 ? void 0 : scripts.filter((scriptSrc) => !this.isValidUserScriptSrc(`'${scriptSrc}'`))) !== null && _b !== void 0 ? _b : [];
         return [...invalidStyles, ...invalidScripts];
     }
+    assertValidFetchClient(fetch) {
+        if (fetch === null || fetch === void 0 ? void 0 : fetch.client) {
+            for (const client of fetch === null || fetch === void 0 ? void 0 : fetch.client) {
+                if (typeof client !== 'string') {
+                    throw new InvalidConnectSrc();
+                }
+            }
+        }
+    }
     mapExternalPermissionsToCsp(externalPermissions) {
         var _a;
         const { images, media, scripts, fetch, styles, fonts, frames } = externalPermissions;
+        this.assertValidFetchClient(fetch);
         return {
             'img-src': images !== null && images !== void 0 ? images : [],
             'media-src': media !== null && media !== void 0 ? media : [],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "1.8.0-next.1",
+  "version": "1.9.0",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,8 +11,8 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "^2.1.2-next.1",
-    "@forge/manifest": "^2.2.1-next.1",
+    "@forge/cli-shared": "^2.2.0",
+    "@forge/manifest": "^3.0.0",
     "@types/jest": "^26.0.0"
   },
   "dependencies": {