@forge/csp 2.1.4-next.1 → 2.1.5-experimental-343ae22

package/CHANGELOG.md

@@ -1,5 +1,40 @@
 # @forge/csp
 
+## 2.1.5-experimental-343ae22
+
+### Major Changes
+
+- 2292902: Update CSP injection to include hostname
+
+## 2.1.5
+
+### Patch Changes
+
+- 8105c45: Bumping dependencies via Renovate:
+
+  - @types/jest
+  - jest
+  - jest-environment-jsdom
+
+## 2.1.5-next.0
+
+### Patch Changes
+
+- 8105c45: Bumping dependencies via Renovate:
+
+  - @types/jest
+  - jest
+  - jest-environment-jsdom
+
+## 2.1.4
+
+### Patch Changes
+
+- 876fe14b: Enable new frame ancestor '\_.stg.atlassian.com'
+- 7129bb40: Bumping dependencies via Renovate:
+
+  - content-security-policy-parser
+
 ## 2.1.4-next.1
 
 ### Patch Changes

package/out/csp/csp-injection-service.d.ts

@@ -5,7 +5,13 @@ export declare class CSPInjectionService {
     private getForgeGlobalCSP;
     private getExistingCSPDetails;
     private getConnectSrc;
+    private isCurrentHostAllowed;
     private getFrameAncestors;
-    getInjectableCSP: (existingCSPDetails: CSPDetails, microsEnv: LambdaEnvironment, tunnelCSPReporterUri?: string) => string[];
+    getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname }: {
+        existingCSPDetails: CSPDetails;
+        microsEnv: LambdaEnvironment;
+        hostname?: string | undefined;
+        tunnelCSPReporterUri?: string | undefined;
+    }) => string[];
 }
 //# sourceMappingURL=csp-injection-service.d.ts.map

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAUvD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAerB,OAAO,CAAC,iBAAiB;IAkBlB,gBAAgB,uBACD,UAAU,aACnB,iBAAiB,yBACL,MAAM,KAC5B,MAAM,EAAE,CAoDT;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAUvD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,oBAAoB;IAK5B,OAAO,CAAC,iBAAiB;IA4BlB,gBAAgB;4BAMD,UAAU;mBACnB,iBAAiB;;;UAG1B,MAAM,EAAE,CAoDV;CACH"}

package/out/csp/csp-injection-service.js

@@ -10,10 +10,10 @@ const atlassianImageHosts = {
 const gravatarUrl = 'https://secure.gravatar.com';
 class CSPInjectionService {
     constructor() {
-        this.getInjectableCSP = (existingCSPDetails, microsEnv, tunnelCSPReporterUri) => {
+        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname }) => {
             const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv);
             const defaultSrc = `'self'`;
-            const frameAncestors = ["'self'", ...this.getFrameAncestors(microsEnv)].join(' ');
+            const frameAncestors = ["'self'", ...this.getFrameAncestors(microsEnv, hostname)].join(' ');
             const frameSrc = ["'self'", ...this.getExistingCSPDetails(types_1.ExternalCspType.FRAME_SRC, existingCSPDetails)].join(' ');
             const fontSrc = ["'self'", ...this.getExistingCSPDetails(types_1.ExternalCspType.FONT_SRC, existingCSPDetails)].join(' ');
             const imgSrc = [
@@ -83,19 +83,31 @@ class CSPInjectionService {
         allowed.push(`https://api.${microsEnv === 'prod' ? '' : 'stg.'}atlassian.com/metal/ingest`);
         return allowed;
     }
-    getFrameAncestors(microsEnv) {
+    isCurrentHostAllowed(hostname) {
+        return true;
+    }
+    getFrameAncestors(microsEnv, hostname) {
+        let frameAncestors = [];
         if (microsEnv === 'dev' || microsEnv === 'stg') {
-            return [
+            frameAncestors = [
                 '*.jira-dev.com',
                 'http://localhost:*',
                 '*.devbucket.org',
                 'https://staging.bb-inf.net',
                 'https://integration.bb-inf.net',
                 '*.atl-paas.net',
-                '*.stg.atlassian.com'
+                '*.stg.atlassian.com',
+                '*.testing.com'
             ];
         }
-        return ['*.atlassian.net', 'bitbucket.org', '*.jira.com', '*.atlassian.com'];
+        else {
+            frameAncestors = ['*.atlassian.net', 'bitbucket.org', '*.jira.com', '*.atlassian.com'];
+        }
+        if (hostname && this.isCurrentHostAllowed(hostname)) {
+            frameAncestors.push(hostname);
+            frameAncestors = [...new Set(frameAncestors)];
+        }
+        return frameAncestors;
     }
 }
 exports.CSPInjectionService = CSPInjectionService;

package/out/csp/csp-processing-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-processing-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-processing-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAS,MAAM,iBAAiB,CAAC;AAK1D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,UAAU,CAAC;AAE7F,qBAAa,iBAAkB,SAAQ,KAAK;;CAI3C;AAMD,qBAAa,oBAAoB;IAanB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXnC,OAAO,CAAC,mBAAmB,CAAuB;IAElD,OAAO,CAAC,2BAA2B,CAAqD;IACxF,OAAO,CAAC,6BAA6B,CAAa;IAClD,OAAO,CAAC,oBAAoB,CAAgF;IAE5G,OAAO,CAAC,qBAAqB,CAI3B;gBAC2B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;IAElD,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,GAAG,UAAU;IAkBvE,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,MAAM,EAAE;IASjF,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,2BAA2B;IAgBnC,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,oBAAoB;CAa7B"}
+{"version":3,"file":"csp-processing-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-processing-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAS,MAAM,iBAAiB,CAAC;AAK1D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,UAAU,CAAC;AAE7F,qBAAa,iBAAkB,SAAQ,KAAK;;CAI3C;AAMD,qBAAa,oBAAoB;IAanB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAXnC,OAAO,CAAC,mBAAmB,CAAuB;IAElD,OAAO,CAAC,2BAA2B,CAAqD;IACxF,OAAO,CAAC,6BAA6B,CAAa;IAClD,OAAO,CAAC,oBAAoB,CAAgF;IAE5G,OAAO,CAAC,qBAAqB,CAI3B;gBAC2B,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC;IAElD,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,GAAG,UAAU;IAoBvE,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,MAAM,EAAE;IASjF,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,2BAA2B;IAgBnC,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,oBAAoB;CAa7B"}

package/out/types.d.ts

@@ -1,8 +1,8 @@
 /// <reference types="node" />
 import type { Permissions } from '@forge/manifest';
-export declare type DocumentBody = string | Buffer;
-export declare type ContentPermissions = NonNullable<Permissions['content']>;
-export declare type ExternalPermissions = NonNullable<Permissions['external']>;
+export type DocumentBody = string | Buffer;
+export type ContentPermissions = NonNullable<Permissions['content']>;
+export type ExternalPermissions = NonNullable<Permissions['external']>;
 export declare enum ExternalCspType {
     IMG_SRC = "img-src",
     MEDIA_SRC = "media-src",
@@ -12,5 +12,5 @@ export declare enum ExternalCspType {
     FONT_SRC = "font-src",
     FRAME_SRC = "frame-src"
 }
-export declare type CSPDetails = Record<ExternalCspType, string[]>;
+export type CSPDetails = Record<ExternalCspType, string[]>;
 //# sourceMappingURL=types.d.ts.map

package/out/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,oBAAY,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,oBAAY,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AACrE,oBAAY,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AACD,oBAAY,UAAU,GAAG,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AACD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "2.1.4-next.1",
+  "version": "2.1.5-experimental-343ae22",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,9 +11,9 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "3.16.0-next.13",
-    "@forge/manifest": "4.16.1-next.5",
-    "@types/jest": "^29.1.2"
+    "@forge/cli-shared": "3.17.2-next.6",
+    "@forge/manifest": "4.19.1-next.3",
+    "@types/jest": "^29.5.3"
   },
   "dependencies": {
     "cheerio": "^0.22.0",