@forge/csp 5.4.0 → 5.5.0-next.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @forge/csp
 
+## 5.5.0-next.1
+
+### Patch Changes
+
+- ddc6274: Add localhost to frameAncestors in prod when passed in appContext
+
+## 5.5.0-next.0
+
+### Minor Changes
+
+- cd25766: Add gasv3 analytics domains
+
 ## 5.4.0
 
 ### Minor Changes

package/out/csp/csp-injection-service.d.ts

@@ -18,14 +18,14 @@ export declare class CSPInjectionService {
     private getExistingCSPDetails;
     private getConnectSrc;
     private getFrameAncestors;
-    getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHostDomain }: {
+    getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost }: {
         existingCSPDetails: CSPDetails;
         microsEnv: LambdaEnvironment;
         tunnelCSPReporterUri?: string | undefined;
         hostname?: string | undefined;
         isFedRAMP?: boolean | undefined;
         icOptions?: IcOptions | undefined;
-        macroParentHostDomain?: string | undefined;
+        macroParentHost?: string | undefined;
     }) => string[];
 }
 export {};

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA8I1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAWjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IA+BrB,OAAO,CAAC,iBAAiB;IA4DlB,gBAAgB;4BASD,UAAU;mBACnB,iBAAiB;;;;;;UAM1B,MAAM,EAAE,CAoFV;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAsJ1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAWjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAkCrB,OAAO,CAAC,iBAAiB;IAkElB,gBAAgB;4BASD,UAAU;mBACnB,iBAAiB;;;;;;UAM1B,MAAM,EAAE,CAoFV;CACH"}

package/out/csp/csp-injection-service.js

@@ -33,6 +33,14 @@ const ATLASSIAN_HOST = {
         'fedramp-prod': 'https://api-media.atlassian-us-gov-mod.com',
         ...makeICHosts((env, icOptions) => `https://media-api.${getICDomain(env, icOptions)}`)
     },
+    ATLASSIAN_ANALYTICS_GATEWAY_HOST: {
+        dev: 'https://as-internal.dev.atl-paas.net',
+        stg: 'https://as-internal.stg.atl-paas.net',
+        prod: 'https://as-internal.prod.atl-paas.net',
+        'fedramp-stg': 'https://as-internal.stg.atlassian-us-gov-mod.com',
+        'fedramp-prod': 'https://as-internal.atlassian-us-gov-mod.com',
+        ...makeICHosts((env, icOptions) => `https://as-internal.${getICDomain(env, icOptions)}`)
+    },
     ATLASSIAN_AVATAR_HOST: {
         dev: 'avatar-management--avatars.us-west-2.staging.public.atl-paas.net',
         stg: 'avatar-management--avatars.us-west-2.staging.public.atl-paas.net',
@@ -121,12 +129,12 @@ exports.getAtlassianImageHost = getAtlassianImageHost;
 exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = ['https://secure.gravatar.com', 'https://images.unsplash.com'];
 class CSPInjectionService {
     constructor() {
-        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHostDomain }) => {
+        this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost }) => {
             const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv, icOptions);
             const defaultSrc = ["'self'", ...getFOSHostDownload(microsEnv, icOptions)].join(' ');
             const frameAncestors = [
                 "'self'",
-                ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHostDomain),
+                ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost),
                 ...getFOSHostDownload(microsEnv, icOptions)
             ].join(' ');
             const frameSrc = [
@@ -235,6 +243,7 @@ class CSPInjectionService {
         allowed.push(metalClientCSP);
         allowed.push(`${getAtlassianHost('ATLASSIAN_API_GATEWAY_HOST', microsEnv, icOptions)}/gateway/api/emoji/`);
         allowed.push(getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions));
+        allowed.push(getAtlassianHost('ATLASSIAN_ANALYTICS_GATEWAY_HOST', microsEnv, icOptions));
         const fopGeHost = getAtlassianHost('ATLASSIAN_FOP_GE_HOST', microsEnv, icOptions);
         if (fopGeHost) {
             allowed.push(fopGeHost);
@@ -243,8 +252,9 @@ class CSPInjectionService {
         allowed.push(...getFOSHostUpload(microsEnv, icOptions));
         return allowed;
     }
-    getFrameAncestors(microsEnv, hostname, icOptions, macroParentHostDomain) {
+    getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost) {
         let frameAncestors = [];
+        const localhostWithPortRegex = /^localhost:\d+$/;
         switch (microsEnv) {
             case 'dev':
             case 'stg':
@@ -256,8 +266,8 @@ class CSPInjectionService {
                     '*.atl-paas.net',
                     '*.stg.atlassian.com'
                 ];
-                if (macroParentHostDomain) {
-                    frameAncestors.push(`${macroParentHostDomain}.cdn.stg.atlassian-dev.net`);
+                if (macroParentHost && !localhostWithPortRegex.test(macroParentHost)) {
+                    frameAncestors.push(`${macroParentHost}.cdn.stg.atlassian-dev.net`);
                 }
                 break;
             case 'fedramp-stg':
@@ -281,8 +291,13 @@ class CSPInjectionService {
                     '*.atlassian.com',
                     '*.frontend.public.atl-paas.net'
                 ];
-                if (macroParentHostDomain) {
-                    frameAncestors.push(`${macroParentHostDomain}.cdn.prod.atlassian-dev.net`);
+                if (macroParentHost) {
+                    if (localhostWithPortRegex.test(macroParentHost)) {
+                        frameAncestors.push(macroParentHost);
+                    }
+                    else {
+                        frameAncestors.push(`${macroParentHost}.cdn.prod.atlassian-dev.net`);
+                    }
                 }
                 break;
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "5.4.0",
+  "version": "5.5.0-next.1",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,8 +11,8 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "8.10.0",
-    "@forge/manifest": "11.1.0",
+    "@forge/cli-shared": "8.11.0-next.4",
+    "@forge/manifest": "11.2.0-next.2",
     "@types/jest": "^29.5.14",
     "@types/node": "20.19.1",
     "cheerio": "^1.1.0"