@forge/csp 5.6.1-next.1 → 5.7.0-experimental-a6c6519

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # @forge/csp
 
+## 5.7.0
+
+### Minor Changes
+
+- 4af6ca2: Added new Forge Object Store CDN URLs
+
+## 5.7.0-next.0
+
+### Minor Changes
+
+- 4af6ca2: Added new Forge Object Store CDN URLs
+
+## 5.6.1
+
+### Patch Changes
+
+- 5a73009: Add hostname to connect-src CSP directive
+- a147579: Add http to localhost url for embedded macro when parent is tunneling
+
 ## 5.6.1-next.1
 
 ### Patch Changes

package/LICENSE.txt

@@ -1,4 +1,4 @@
-Copyright (c) 2025 Atlassian
+Copyright (c) 2026 Atlassian
 Permission is hereby granted to use this software in accordance with the terms 
 and conditions outlined in the Atlassian Developer Terms, which can be found 
 at the following URL:

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAsJ1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAWjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAkCrB,OAAO,CAAC,iBAAiB;IAkElB,gBAAgB;4BASD,UAAU;mBACnB,iBAAiB;;;;;;UAM1B,MAAM,EAAE,CAwFV;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA8K1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAWjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,iBAAiB;IAkElB,gBAAgB;4BASD,UAAU;mBACnB,iBAAiB;;;;;;UAM1B,MAAM,EAAE,CAgGV;CACH"}

package/out/csp/csp-injection-service.js

@@ -101,6 +101,19 @@ const getAtlassianHost = (hostType, microsEnv, icOptions) => {
     }
     return hostMap[microsEnv];
 };
+const FOS_CDN_STANDARD_HOST = {
+    dev: 'https://object-store.stg.atlassian.com',
+    stg: 'https://object-store.stg.atlassian.com',
+    prod: 'https://object-store.atlassian.com'
+};
+const FOS_CDN_IC_HOST = makeICHosts((env, icOptions) => `https://object-store.${getICDomain(env, icOptions)}`);
+const FOS_CDN_PATH = '/os/ecosystem/installation/';
+const getFOSCDNHost = (microsEnv, icOptions) => {
+    if (isICEnvKey(microsEnv)) {
+        return icOptions ? FOS_CDN_IC_HOST[microsEnv](icOptions) : undefined;
+    }
+    return FOS_CDN_STANDARD_HOST[microsEnv];
+};
 const getFOSHostDownload = (microsEnv, icOptions) => {
     const fosHost = getAtlassianHost('ATLASSIAN_FOS_HOST', microsEnv, icOptions);
     return isICEnvKey(microsEnv)
@@ -113,6 +126,10 @@ const getFOSHostUpload = (microsEnv, icOptions) => {
         ? [`${fosHost}/fos/app/upload/`, `${fosHost}/fos/cdn/upload/`]
         : [`${fosHost}/fos-eap/upload/`, `${fosHost}/fos/app/upload/`, `${fosHost}/fos/cdn/upload/`];
 };
+const getFOSCDNUrls = (microsEnv, icOptions) => {
+    const fosCDNHost = getFOSCDNHost(microsEnv, icOptions);
+    return fosCDNHost ? [`${fosCDNHost}${FOS_CDN_PATH}`] : [];
+};
 const getAtlassianImageHost = (microsEnv, icOptions) => {
     return [
         `https://${getAtlassianHost('ATLASSIAN_AVATAR_HOST', microsEnv, icOptions)}`,
@@ -131,24 +148,28 @@ class CSPInjectionService {
     constructor() {
         this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost }) => {
             const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv, icOptions);
-            const defaultSrc = ["'self'", ...getFOSHostDownload(microsEnv, icOptions)].join(' ');
+            const fosCDNUrls = getFOSCDNUrls(microsEnv, icOptions);
+            const defaultSrc = ["'self'", ...getFOSHostDownload(microsEnv, icOptions), ...fosCDNUrls].join(' ');
             const frameAncestors = [
                 "'self'",
                 ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost),
-                ...getFOSHostDownload(microsEnv, icOptions)
+                ...getFOSHostDownload(microsEnv, icOptions),
+                ...fosCDNUrls
             ].join(' ');
             const frameSrc = [
                 "'self'",
                 hostname,
                 getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions),
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.FRAME_SRC, existingCSPDetails),
-                ...getFOSHostDownload(microsEnv, icOptions)
+                ...getFOSHostDownload(microsEnv, icOptions),
+                ...fosCDNUrls
             ]
                 .filter((a) => a)
                 .join(' ');
             const fontSrc = [
                 "'self'",
                 ...getFOSHostDownload(microsEnv, icOptions),
+                ...fosCDNUrls,
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.FONT_SRC, existingCSPDetails)
             ].join(' ');
             const imgSrc = [
@@ -158,6 +179,7 @@ class CSPInjectionService {
                 hostname,
                 ...exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS,
                 ...(0, exports.getAtlassianImageHost)(microsEnv, icOptions),
+                ...fosCDNUrls,
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.IMG_SRC, existingCSPDetails)
             ]
                 .filter((a) => a)
@@ -169,7 +191,8 @@ class CSPInjectionService {
                 hostname,
                 getAtlassianHost('ATLASSIAN_MEDIA_GATEWAY_HOST', microsEnv, icOptions),
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.MEDIA_SRC, existingCSPDetails),
-                ...getFOSHostDownload(microsEnv, icOptions)
+                ...getFOSHostDownload(microsEnv, icOptions),
+                ...fosCDNUrls
             ]
                 .filter((a) => a)
                 .join(' ');
@@ -186,6 +209,7 @@ class CSPInjectionService {
                 "'self'",
                 this.getForgeGlobalCSP(microsEnv, isFedRAMP, icOptions),
                 ...getFOSHostDownload(microsEnv, icOptions),
+                ...fosCDNUrls,
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.SCRIPT_SRC, existingCSPDetails)
             ].join(' ');
             const styleSrc = [
@@ -193,6 +217,7 @@ class CSPInjectionService {
                 hostname,
                 this.getForgeGlobalCSP(microsEnv, isFedRAMP, icOptions),
                 ...getFOSHostDownload(microsEnv, icOptions),
+                ...fosCDNUrls,
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.STYLE_SRC, existingCSPDetails)
             ]
                 .filter((a) => a)
@@ -253,6 +278,7 @@ class CSPInjectionService {
         }
         allowed.push(...getFOSHostDownload(microsEnv, icOptions));
         allowed.push(...getFOSHostUpload(microsEnv, icOptions));
+        allowed.push(...getFOSCDNUrls(microsEnv, icOptions));
         return allowed;
     }
     getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "5.6.1-next.1",
+  "version": "5.7.0-experimental-a6c6519",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,8 +11,8 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "8.12.1-next.3",
-    "@forge/manifest": "11.3.1-next.3",
+    "@forge/cli-shared": "8.20.0-experimental-a6c6519",
+    "@forge/manifest": "12.6.0-experimental-a6c6519",
     "@types/jest": "^29.5.14",
     "@types/node": "20.19.1",
     "cheerio": "^1.1.0"