@forge/csp 5.3.0 → 5.4.0-next.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/CHANGELOG.md +12 -0
  2. package/out/csp/csp-injection-service.d.ts +2 -1
  3. package/out/csp/csp-injection-service.d.ts.map +1 -1
  4. package/out/csp/csp-injection-service.js +15 -5
  5. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -1,5 +1,17 @@
1
1
  # @forge/csp
2
2
 
3
+ ## 5.4.0-next.1
4
+
5
+ ### Patch Changes
6
+
7
+ - 6a0cb5e: Add macroParentHostDomain.cdn.[env].atlassian-dev.net conditionally to frameAncestors
8
+
9
+ ## 5.4.0-next.0
10
+
11
+ ### Minor Changes
12
+
13
+ - 901ffb2: Correct FOS CSP
14
+
3
15
  ## 5.3.0
4
16
 
5
17
  ### Minor Changes
package/out/csp/csp-injection-service.d.ts CHANGED
@@ -18,13 +18,14 @@ export declare class CSPInjectionService {
18
18
  private getExistingCSPDetails;
19
19
  private getConnectSrc;
20
20
  private getFrameAncestors;
21
- getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions }: {
21
+ getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHostDomain }: {
22
22
  existingCSPDetails: CSPDetails;
23
23
  microsEnv: LambdaEnvironment;
24
24
  tunnelCSPReporterUri?: string | undefined;
25
25
  hostname?: string | undefined;
26
26
  isFedRAMP?: boolean | undefined;
27
27
  icOptions?: IcOptions | undefined;
28
+ macroParentHostDomain?: string | undefined;
28
29
  }) => string[];
29
30
  }
30
31
  export {};
package/out/csp/csp-injection-service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAwI1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAWjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IA+BrB,OAAO,CAAC,iBAAiB;IAiDlB,gBAAgB;4BAQD,UAAU;mBACnB,iBAAiB;;;;;UAK1B,MAAM,EAAE,CAoFV;CACH"}
1
+ {"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA8I1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAWjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IA+BrB,OAAO,CAAC,iBAAiB;IA4DlB,gBAAgB;4BASD,UAAU;mBACnB,iBAAiB;;;;;;UAM1B,MAAM,EAAE,CAoFV;CACH"}
package/out/csp/csp-injection-service.js CHANGED
@@ -95,11 +95,15 @@ const getAtlassianHost = (hostType, microsEnv, icOptions) => {
95
95
  };
96
96
  const getFOSHostDownload = (microsEnv, icOptions) => {
97
97
  const fosHost = getAtlassianHost('ATLASSIAN_FOS_HOST', microsEnv, icOptions);
98
- return [`${fosHost}/fos-eap/download/`, `${fosHost}/fop/app/download/`, `${fosHost}/fop/cdn/download/`];
98
+ return isICEnvKey(microsEnv)
99
+ ? [`${fosHost}/fos/app/download/`, `${fosHost}/fos/cdn/download/`]
100
+ : [`${fosHost}/fos-eap/download/`, `${fosHost}/fos/app/download/`, `${fosHost}/fos/cdn/download/`];
99
101
  };
100
102
  const getFOSHostUpload = (microsEnv, icOptions) => {
101
103
  const fosHost = getAtlassianHost('ATLASSIAN_FOS_HOST', microsEnv, icOptions);
102
- return [`${fosHost}/fos-eap/upload/`, `${fosHost}/fop/app/upload/`, `${fosHost}/fop/cdn/upload/`];
104
+ return isICEnvKey(microsEnv)
105
+ ? [`${fosHost}/fos/app/upload/`, `${fosHost}/fos/cdn/upload/`]
106
+ : [`${fosHost}/fos-eap/upload/`, `${fosHost}/fos/app/upload/`, `${fosHost}/fos/cdn/upload/`];
103
107
  };
104
108
  const getAtlassianImageHost = (microsEnv, icOptions) => {
105
109
  return [
@@ -117,12 +121,12 @@ exports.getAtlassianImageHost = getAtlassianImageHost;
117
121
  exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = ['https://secure.gravatar.com', 'https://images.unsplash.com'];
118
122
  class CSPInjectionService {
119
123
  constructor() {
120
- this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions }) => {
124
+ this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHostDomain }) => {
121
125
  const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv, icOptions);
122
126
  const defaultSrc = ["'self'", ...getFOSHostDownload(microsEnv, icOptions)].join(' ');
123
127
  const frameAncestors = [
124
128
  "'self'",
125
- ...this.getFrameAncestors(microsEnv, hostname, icOptions),
129
+ ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHostDomain),
126
130
  ...getFOSHostDownload(microsEnv, icOptions)
127
131
  ].join(' ');
128
132
  const frameSrc = [
@@ -239,7 +243,7 @@ class CSPInjectionService {
239
243
  allowed.push(...getFOSHostUpload(microsEnv, icOptions));
240
244
  return allowed;
241
245
  }
242
- getFrameAncestors(microsEnv, hostname, icOptions) {
246
+ getFrameAncestors(microsEnv, hostname, icOptions, macroParentHostDomain) {
243
247
  let frameAncestors = [];
244
248
  switch (microsEnv) {
245
249
  case 'dev':
@@ -252,6 +256,9 @@ class CSPInjectionService {
252
256
  '*.atl-paas.net',
253
257
  '*.stg.atlassian.com'
254
258
  ];
259
+ if (macroParentHostDomain) {
260
+ frameAncestors.push(`${macroParentHostDomain}.cdn.stg.atlassian-dev.net`);
261
+ }
255
262
  break;
256
263
  case 'fedramp-stg':
257
264
  frameAncestors = ['*.atlassian-stg-fedm.net'];
@@ -274,6 +281,9 @@ class CSPInjectionService {
274
281
  '*.atlassian.com',
275
282
  '*.frontend.public.atl-paas.net'
276
283
  ];
284
+ if (macroParentHostDomain) {
285
+ frameAncestors.push(`${macroParentHostDomain}.cdn.prod.atlassian-dev.net`);
286
+ }
277
287
  break;
278
288
  }
279
289
  if (hostname) {
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@forge/csp",
3
- "version": "5.3.0",
3
+ "version": "5.4.0-next.1",
4
4
  "description": "Contains the CSP configuration for Custom UI resources in Forge",
5
5
  "main": "out/index.js",
6
6
  "author": "Atlassian",
@@ -11,8 +11,8 @@
11
11
  "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
12
12
  },
13
13
  "devDependencies": {
14
- "@forge/cli-shared": "8.9.0",
15
- "@forge/manifest": "11.0.0",
14
+ "@forge/cli-shared": "8.9.1-next.6",
15
+ "@forge/manifest": "11.1.0-next.4",
16
16
  "@types/jest": "^29.5.14",
17
17
  "@types/node": "20.19.1",
18
18
  "cheerio": "^1.1.0"