@forge/csp 5.1.2-next.0 → 5.2.0-next.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @forge/csp
 
+## 5.2.0-next.2
+
+### Patch Changes
+
+- 6864e48: Adding FOS to img-src and script-src CSP
+
+## 5.2.0-next.1
+
+### Minor Changes
+
+- 5403345: Adding FOS to connect-src CSP
+
 ## 5.1.2-next.0
 
 ### Patch Changes

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAiH1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAUjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IA2BrB,OAAO,CAAC,iBAAiB;IAiDlB,gBAAgB;4BAQD,UAAU;mBACnB,iBAAiB;;;;;UAK1B,MAAM,EAAE,CAkEV;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAsI1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAUjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,iBAAiB;IAiDlB,gBAAgB;4BAQD,UAAU;mBACnB,iBAAiB;;;;;UAK1B,MAAM,EAAE,CAoEV;CACH"}

package/out/csp/csp-injection-service.js

@@ -73,6 +73,14 @@ const ATLASSIAN_HOST = {
         'fedramp-stg': '',
         'fedramp-prod': '',
         ...makeICHosts((env, icOptions) => '')
+    },
+    ATLASSIAN_FOS_HOST: {
+        dev: 'https://tdp-os.dev.services.atlassian.com',
+        stg: 'https://tdp-os.stg.services.atlassian.com',
+        prod: 'https://tdp-os.services.atlassian.com',
+        'fedramp-stg': 'https://tdp-os.stg.services.atlassian-us-gov-mod.com',
+        'fedramp-prod': 'https://tdp-os.services.atlassian-us-gov-mod.com',
+        ...makeICHosts((env, icOptions) => `https://tdp-os.services.${getICDomain(env, icOptions)}`)
     }
 };
 const getAtlassianHost = (hostType, microsEnv, icOptions) => {
@@ -85,6 +93,17 @@ const getAtlassianHost = (hostType, microsEnv, icOptions) => {
     }
     return hostMap[microsEnv];
 };
+const getFOSHost = (microsEnv, icOptions) => {
+    const fosHost = getAtlassianHost('ATLASSIAN_FOS_HOST', microsEnv, icOptions);
+    return [
+        `${fosHost}/fos-eap/upload/*/`,
+        `${fosHost}/fos-eap/download/*/`,
+        `${fosHost}/fop/app/upload/*/`,
+        `${fosHost}/fop/app/download/*/`,
+        `${fosHost}/fop/cdn/upload/*/`,
+        `${fosHost}/fop/cdn/download/*/`
+    ];
+};
 const getAtlassianImageHost = (microsEnv, icOptions) => {
     return [
         `https://${getAtlassianHost('ATLASSIAN_AVATAR_HOST', microsEnv, icOptions)}`,
@@ -115,6 +134,7 @@ class CSPInjectionService {
                 hostname,
                 ...exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS,
                 ...(0, exports.getAtlassianImageHost)(microsEnv, icOptions),
+                ...getFOSHost(microsEnv, icOptions),
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.IMG_SRC, existingCSPDetails)
             ]
                 .filter((a) => a)
@@ -137,6 +157,7 @@ class CSPInjectionService {
             const scriptSrc = [
                 "'self'",
                 this.getForgeGlobalCSP(microsEnv, isFedRAMP, icOptions),
+                ...getFOSHost(microsEnv, icOptions),
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.SCRIPT_SRC, existingCSPDetails)
             ].join(' ');
             const styleSrc = [
@@ -200,6 +221,7 @@ class CSPInjectionService {
         if (fopGeHost) {
             allowed.push(fopGeHost);
         }
+        allowed.push(...getFOSHost(microsEnv, icOptions));
         return allowed;
     }
     getFrameAncestors(microsEnv, hostname, icOptions) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "5.1.2-next.0",
+  "version": "5.2.0-next.2",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,8 +11,8 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "8.8.1-next.0",
-    "@forge/manifest": "10.7.1-next.0",
+    "@forge/cli-shared": "8.8.1-next.1",
+    "@forge/manifest": "10.8.0-next.1",
     "@types/jest": "^29.5.14",
     "@types/node": "20.19.1",
     "cheerio": "^1.1.0"