@forge/csp 2.2.3 → 3.0.0

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @forge/csp
 
+## 3.0.0
+
+### Major Changes
+
+- f38e3f86: Add support for adding hostname to frame ancestor when getting injectable CSP
+
+## 3.0.0-next.0
+
+### Major Changes
+
+- f38e3f86: Add support for adding hostname to frame ancestor when getting injectable CSP
+
 ## 2.2.3
 
 ### Patch Changes

package/out/csp/csp-injection-service.d.ts

@@ -6,6 +6,11 @@ export declare class CSPInjectionService {
     private getExistingCSPDetails;
     private getConnectSrc;
     private getFrameAncestors;
-    getInjectableCSP: (existingCSPDetails: CSPDetails, microsEnv: LambdaEnvironment, tunnelCSPReporterUri?: string) => string[];
+    getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname }: {
+        existingCSPDetails: CSPDetails;
+        microsEnv: LambdaEnvironment;
+        tunnelCSPReporterUri?: string | undefined;
+        hostname?: string | undefined;
+    }) => string[];
 }
 //# sourceMappingURL=csp-injection-service.d.ts.map

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAmBvD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,iBAAiB;IAyBlB,gBAAgB,uBACD,UAAU,aACnB,iBAAiB,yBACL,MAAM,KAC5B,MAAM,EAAE,CAoDT;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAmBvD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;IAIzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAgBrB,OAAO,CAAC,iBAAiB;IA8BlB,gBAAgB;4BAMD,UAAU;mBACnB,iBAAiB;;;UAG1B,MAAM,EAAE,CAoDV;CACH"}

package/out/csp/csp-injection-service.js

@@ -17,10 +17,10 @@ const atlassianImageHosts = {
 const gravatarUrl = 'https://secure.gravatar.com';
 class CSPInjectionService {
     constructor() {
-        this.getInjectableCSP = (existingCSPDetails, microsEnv, tunnelCSPReporterUri) => {
+        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname }) => {
             const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv);
             const defaultSrc = `'self'`;
-            const frameAncestors = ["'self'", ...this.getFrameAncestors(microsEnv)].join(' ');
+            const frameAncestors = ["'self'", ...this.getFrameAncestors(microsEnv, hostname)].join(' ');
             const frameSrc = ["'self'", ...this.getExistingCSPDetails(types_1.ExternalCspType.FRAME_SRC, existingCSPDetails)].join(' ');
             const fontSrc = ["'self'", ...this.getExistingCSPDetails(types_1.ExternalCspType.FONT_SRC, existingCSPDetails)].join(' ');
             const imgSrc = [
@@ -90,9 +90,10 @@ class CSPInjectionService {
         allowed.push(`https://api.${microsEnv === 'prod' ? '' : 'stg.'}atlassian.com/metal/ingest`);
         return allowed;
     }
-    getFrameAncestors(microsEnv) {
+    getFrameAncestors(microsEnv, hostname) {
+        let frameAncestors = [];
         if (microsEnv === 'dev' || microsEnv === 'stg') {
-            return [
+            frameAncestors = [
                 '*.jira-dev.com',
                 'http://localhost:*',
                 '*.devbucket.org',
@@ -102,13 +103,19 @@ class CSPInjectionService {
                 '*.stg.atlassian.com'
             ];
         }
-        if (microsEnv === 'fex') {
-            return [
+        else if (microsEnv === 'fex') {
+            frameAncestors = [
                 '*.atlassian-fex.net',
                 'http://localhost:*'
             ];
         }
-        return ['*.atlassian.net', 'bitbucket.org', '*.jira.com', '*.atlassian.com'];
+        else {
+            frameAncestors = ['*.atlassian.net', 'bitbucket.org', '*.jira.com', '*.atlassian.com'];
+        }
+        if (hostname) {
+            frameAncestors.push(hostname);
+        }
+        return frameAncestors;
     }
 }
 exports.CSPInjectionService = CSPInjectionService;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "2.2.3",
+  "version": "3.0.0",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,7 +11,7 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "3.20.0",
+    "@forge/cli-shared": "3.20.1",
     "@forge/manifest": "4.20.2",
     "@types/ignore-walk": "^4.0.1",
     "@types/jest": "^29.5.5",