@forge/csp 5.2.0-next.2 → 5.2.0-next.4

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @forge/csp
 
+## 5.2.0-next.4
+
+### Patch Changes
+
+- bafc49d: add fos hosts to getAtlassianImageHost
+
+## 5.2.0-next.3
+
+### Patch Changes
+
+- f45e95a: Adding FOS to font-src and style-src CSP
+
 ## 5.2.0-next.2
 
 ### Patch Changes

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAsI1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAUjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IA6BrB,OAAO,CAAC,iBAAiB;IAiDlB,gBAAgB;4BAQD,UAAU;mBACnB,iBAAiB;;;;;UAK1B,MAAM,EAAE,CAoEV;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAoI1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAWjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IA8BrB,OAAO,CAAC,iBAAiB;IAiDlB,gBAAgB;4BAQD,UAAU;mBACnB,iBAAiB;;;;;UAK1B,MAAM,EAAE,CAwEV;CACH"}

package/out/csp/csp-injection-service.js

@@ -93,16 +93,13 @@ const getAtlassianHost = (hostType, microsEnv, icOptions) => {
     }
     return hostMap[microsEnv];
 };
-const getFOSHost = (microsEnv, icOptions) => {
+const getFOSHostDownload = (microsEnv, icOptions) => {
     const fosHost = getAtlassianHost('ATLASSIAN_FOS_HOST', microsEnv, icOptions);
-    return [
-        `${fosHost}/fos-eap/upload/*/`,
-        `${fosHost}/fos-eap/download/*/`,
-        `${fosHost}/fop/app/upload/*/`,
-        `${fosHost}/fop/app/download/*/`,
-        `${fosHost}/fop/cdn/upload/*/`,
-        `${fosHost}/fop/cdn/download/*/`
-    ];
+    return [`${fosHost}/fos-eap/download/*/`, `${fosHost}/fop/app/download/*/`, `${fosHost}/fop/cdn/download/*/`];
+};
+const getFOSHostUpload = (microsEnv, icOptions) => {
+    const fosHost = getAtlassianHost('ATLASSIAN_FOS_HOST', microsEnv, icOptions);
+    return [`${fosHost}/fos-eap/upload/*/`, `${fosHost}/fop/app/upload/*/`, `${fosHost}/fop/cdn/upload/*/`];
 };
 const getAtlassianImageHost = (microsEnv, icOptions) => {
     return [
@@ -112,7 +109,8 @@ const getAtlassianImageHost = (microsEnv, icOptions) => {
         getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions),
         getAtlassianHost('ATLASSIAN_EMOJIS_HOST', microsEnv, icOptions),
         getAtlassianHost('ATLASSIAN_TEAM_AVATAR_HOST', microsEnv, icOptions),
-        getAtlassianHost('ATLASSIAN_TEAM_HEADER_HOST', microsEnv, icOptions)
+        getAtlassianHost('ATLASSIAN_TEAM_HEADER_HOST', microsEnv, icOptions),
+        ...getFOSHostDownload(microsEnv, icOptions)
     ];
 };
 exports.getAtlassianImageHost = getAtlassianImageHost;
@@ -126,7 +124,11 @@ class CSPInjectionService {
             const frameSrc = ["'self'", hostname, ...this.getExistingCSPDetails(types_1.ExternalCspType.FRAME_SRC, existingCSPDetails)]
                 .filter((a) => a)
                 .join(' ');
-            const fontSrc = ["'self'", ...this.getExistingCSPDetails(types_1.ExternalCspType.FONT_SRC, existingCSPDetails)].join(' ');
+            const fontSrc = [
+                "'self'",
+                ...getFOSHostDownload(microsEnv, icOptions),
+                ...this.getExistingCSPDetails(types_1.ExternalCspType.FONT_SRC, existingCSPDetails)
+            ].join(' ');
             const imgSrc = [
                 "'self'",
                 'data:',
@@ -134,7 +136,6 @@ class CSPInjectionService {
                 hostname,
                 ...exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS,
                 ...(0, exports.getAtlassianImageHost)(microsEnv, icOptions),
-                ...getFOSHost(microsEnv, icOptions),
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.IMG_SRC, existingCSPDetails)
             ]
                 .filter((a) => a)
@@ -157,13 +158,14 @@ class CSPInjectionService {
             const scriptSrc = [
                 "'self'",
                 this.getForgeGlobalCSP(microsEnv, isFedRAMP, icOptions),
-                ...getFOSHost(microsEnv, icOptions),
+                ...getFOSHostDownload(microsEnv, icOptions),
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.SCRIPT_SRC, existingCSPDetails)
             ].join(' ');
             const styleSrc = [
                 "'self'",
                 hostname,
                 this.getForgeGlobalCSP(microsEnv, isFedRAMP, icOptions),
+                ...getFOSHostDownload(microsEnv, icOptions),
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.STYLE_SRC, existingCSPDetails)
             ]
                 .filter((a) => a)
@@ -221,7 +223,8 @@ class CSPInjectionService {
         if (fopGeHost) {
             allowed.push(fopGeHost);
         }
-        allowed.push(...getFOSHost(microsEnv, icOptions));
+        allowed.push(...getFOSHostDownload(microsEnv, icOptions));
+        allowed.push(...getFOSHostUpload(microsEnv, icOptions));
         return allowed;
     }
     getFrameAncestors(microsEnv, hostname, icOptions) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "5.2.0-next.2",
+  "version": "5.2.0-next.4",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,8 +11,8 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "8.8.1-next.1",
-    "@forge/manifest": "10.8.0-next.1",
+    "@forge/cli-shared": "8.8.1-next.3",
+    "@forge/manifest": "10.8.0-next.3",
     "@types/jest": "^29.5.14",
     "@types/node": "20.19.1",
     "cheerio": "^1.1.0"