@forge/csp 4.0.1-next.0 → 4.0.1-next.1-experimental-effab31

package/CHANGELOG.md

@@ -1,5 +1,22 @@
 # @forge/csp
 
+## 4.0.1-next.1-experimental-effab31
+
+### Minor Changes
+
+- effab31: Bumped cheerio from 0.22 to 1.1
+
+### Patch Changes
+
+- 195411c: patch dependencies
+- f5ba3aa: Allow-list Atlassian media URLs by default for media CSP policies
+
+## 4.0.1-next.1
+
+### Patch Changes
+
+- f5ba3aa: Allow-list Atlassian media URLs by default for media CSP policies
+
 ## 4.0.1-next.0
 
 ### Patch Changes

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AA2DvD,eAAO,MAAM,sBAAsB,EAAE;KAAG,SAAS,IAAI,iBAAiB,GAAG,MAAM,EAAE;CA8ChF,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,iBAAiB;IAoClB,gBAAgB;4BAOD,UAAU;mBACnB,iBAAiB;;;;UAI1B,MAAM,EAAE,CA6DV;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AA2DvD,eAAO,MAAM,sBAAsB,EAAE;KAAG,SAAS,IAAI,iBAAiB,GAAG,MAAM,EAAE;CA8ChF,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,iBAAiB;IAMzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAsBrB,OAAO,CAAC,iBAAiB;IAoClB,gBAAgB;4BAOD,UAAU;mBACnB,iBAAiB;;;;UAI1B,MAAM,EAAE,CA8DV;CACH"}

package/out/csp/csp-injection-service.js

@@ -172,6 +172,7 @@ class CSPInjectionService {
             'data:',
             'blob:',
             hostname,
+            ATLASSIAN_MEDIA_GATEWAY_HOST[microsEnv],
             ...this.getExistingCSPDetails(types_1.ExternalCspType.MEDIA_SRC, existingCSPDetails)
         ]
             .filter((a) => a)

package/out/csp/csp-processing-service.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.CSPProcessingService = exports.InvalidConnectSrc = void 0;
 const tslib_1 = require("tslib");
-const cheerio_1 = tslib_1.__importDefault(require("cheerio"));
+const cheerio_1 = require("cheerio");
 const content_security_policy_parser_1 = tslib_1.__importDefault(require("content-security-policy-parser"));
 const crypto_1 = tslib_1.__importDefault(require("crypto"));
 class InvalidConnectSrc extends Error {
@@ -28,7 +28,7 @@ class CSPProcessingService {
     getCspDetails(body, permissions) {
         const { scripts, styles } = permissions?.content ?? { scripts: [], styles: [] };
         const external = permissions?.external ?? {};
-        const $ = cheerio_1.default.load(body);
+        const $ = (0, cheerio_1.load)(body, { xml: { xmlMode: false } });
         const { 'script-src': scriptSrc, 'style-src': styleSrc, ...mappedExternalCsp } = this.mapExternalPermissionsToCsp(external);
         return {
             'style-src': [...this.getStyleSrc($, styles), ...styleSrc],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "4.0.1-next.0",
+  "version": "4.0.1-next.1-experimental-effab31",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,13 +11,13 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "8.0.1-next.4",
-    "@forge/manifest": "10.0.1-next.4",
+    "@forge/cli-shared": "8.1.0-next.7-experimental-effab31",
+    "@forge/manifest": "10.0.1-next.7-experimental-effab31",
     "@types/jest": "^29.5.14",
     "@types/node": "20.19.1"
   },
   "dependencies": {
-    "cheerio": "^0.22.0",
+    "cheerio": "^1.1.0",
     "content-security-policy-parser": "^0.4.1"
   },
   "publishConfig": {