@forge/csp 6.0.0-next.3 → 6.1.0-next.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (10) hide show
  1. package/CHANGELOG.md +22 -0
  2. package/out/csp/csp-injection-service.d.ts +11 -10
  3. package/out/csp/csp-injection-service.d.ts.map +1 -1
  4. package/out/csp/csp-injection-service.js +6 -3
  5. package/out/csp/csp-processing-service.d.ts +1 -1
  6. package/out/csp/csp-processing-service.d.ts.map +1 -1
  7. package/out/types.d.ts +4 -6
  8. package/out/types.d.ts.map +1 -1
  9. package/out/types.js +1 -1
  10. package/package.json +3 -3
package/CHANGELOG.md CHANGED
@@ -1,5 +1,27 @@
1
1
  # @forge/csp
2
2
 
3
+ ## 6.1.0-next.0
4
+
5
+ ### Minor Changes
6
+
7
+ - 9390d98: Add optional `parentEmbeddingDomain` parameter to the CSP injection service. When provided, the domain is appended to the `frame-ancestors` directive, allowing Forge apps embedded in Confluence pages served on a custom parent domain to load.
8
+
9
+ ## 6.0.0
10
+
11
+ ### Major Changes
12
+
13
+ - 78fcb7f: Adds support for TypeScript 5
14
+
15
+ ### Minor Changes
16
+
17
+ - 297d598: Added FOS CDN Urls to getAtlassianImageHost for IC
18
+
19
+ ### Patch Changes
20
+
21
+ - 661b109: Trigger re-publish of @forge/csp to include getFOSCDNUrls in getAtlassianImageHost
22
+ - 55c1371: bump cheerio to ^1.2.0 to pull in a patched undici (>=7.19.0, resolving to a fixed release) and remediate CVE-2026-1525
23
+ NodeJS requirement bumped from 20.0.0 to >=20.18.1
24
+
3
25
  ## 6.0.0-next.3
4
26
 
5
27
  ### Major Changes
package/out/csp/csp-injection-service.d.ts CHANGED
@@ -1,14 +1,14 @@
1
1
  import type { LambdaEnvironment } from '@forge/cli-shared';
2
2
  import { CSPDetails } from '../types';
3
- declare type StandardIcOptions = {
3
+ type StandardIcOptions = {
4
4
  icLabel: string;
5
5
  serviceName: string;
6
6
  };
7
- declare type GetICDomainIcOptions = {
7
+ type GetICDomainIcOptions = {
8
8
  serviceName?: string;
9
9
  getICDomain: () => string;
10
10
  };
11
- declare type IcOptions = StandardIcOptions | GetICDomainIcOptions;
11
+ type IcOptions = StandardIcOptions | GetICDomainIcOptions;
12
12
  export declare const getAtlassianImageHost: (microsEnv: LambdaEnvironment, icOptions?: IcOptions) => string[];
13
13
  export declare const EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS: string[];
14
14
  export declare class CSPInjectionService {
@@ -18,15 +18,16 @@ export declare class CSPInjectionService {
18
18
  private getExistingCSPDetails;
19
19
  private getConnectSrc;
20
20
  private getFrameAncestors;
21
- getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain }: {
21
+ getInjectableCSP: ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain }: {
22
22
  existingCSPDetails: CSPDetails;
23
23
  microsEnv: LambdaEnvironment;
24
- tunnelCSPReporterUri?: string | undefined;
25
- hostname?: string | undefined;
26
- isFedRAMP?: boolean | undefined;
27
- icOptions?: IcOptions | undefined;
28
- macroParentHost?: string | undefined;
29
- connectMacroParentDomain?: string | undefined;
24
+ tunnelCSPReporterUri?: string;
25
+ hostname?: string;
26
+ isFedRAMP?: boolean;
27
+ icOptions?: IcOptions;
28
+ macroParentHost?: string;
29
+ connectMacroParentDomain?: string;
30
+ parentEmbeddingDomain?: string;
30
31
  }) => string[];
31
32
  }
32
33
  export {};
package/out/csp/csp-injection-service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,aAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,aAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,aAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA+K1D,eAAO,MAAM,qBAAqB,cAAe,iBAAiB,cAAc,SAAS,KAAG,MAAM,EAYjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,iBAAiB;IAuElB,gBAAgB;4BAUD,UAAU;mBACnB,iBAAiB;;;;;;;UAO1B,MAAM,EAAE,CA+FV;CACH"}
1
+ {"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA+K1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAYjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAmCrB,OAAO,CAAC,iBAAiB;IA4ElB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAsGV;CACH"}
package/out/csp/csp-injection-service.js CHANGED
@@ -147,13 +147,13 @@ exports.getAtlassianImageHost = getAtlassianImageHost;
147
147
  exports.EXTERNAL_ALLOW_LISTED_IMAGES_HOSTS = ['https://secure.gravatar.com', 'https://images.unsplash.com'];
148
148
  class CSPInjectionService {
149
149
  constructor() {
150
- this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain }) => {
150
+ this.getInjectableCSP = ({ existingCSPDetails, microsEnv, tunnelCSPReporterUri, hostname, isFedRAMP, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain }) => {
151
151
  const reportUri = tunnelCSPReporterUri || this.getCSPReportUri(microsEnv, icOptions);
152
152
  const fosCDNUrls = getFOSCDNUrls(microsEnv, icOptions);
153
153
  const defaultSrc = ["'self'", ...getFOSHostDownload(microsEnv, icOptions), ...fosCDNUrls].join(' ');
154
154
  const frameAncestors = [
155
155
  "'self'",
156
- ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain),
156
+ ...this.getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain),
157
157
  ...getFOSHostDownload(microsEnv, icOptions),
158
158
  ...fosCDNUrls
159
159
  ].join(' ');
@@ -281,7 +281,7 @@ class CSPInjectionService {
281
281
  allowed.push(...getFOSCDNUrls(microsEnv, icOptions));
282
282
  return allowed;
283
283
  }
284
- getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain) {
284
+ getFrameAncestors(microsEnv, hostname, icOptions, macroParentHost, connectMacroParentDomain, parentEmbeddingDomain) {
285
285
  let frameAncestors = [];
286
286
  const localhostWithPortRegex = /^localhost:\d+$/;
287
287
  switch (microsEnv) {
@@ -333,6 +333,9 @@ class CSPInjectionService {
333
333
  if (connectMacroParentDomain) {
334
334
  frameAncestors.push(connectMacroParentDomain);
335
335
  }
336
+ if (parentEmbeddingDomain) {
337
+ frameAncestors.push(parentEmbeddingDomain);
338
+ }
336
339
  if (hostname) {
337
340
  frameAncestors.push(hostname);
338
341
  }
package/out/csp/csp-processing-service.d.ts CHANGED
@@ -2,7 +2,7 @@ import type { Logger } from '@forge/cli-shared';
2
2
  import type { Permissions } from '@forge/manifest';
3
3
  import type { CheerioAPI, CheerioOptions } from 'cheerio/slim';
4
4
  import { ContentPermissions, CSPDetails, DocumentBody } from '../types';
5
- declare type CheerioLoader = (document: DocumentBody, options?: CheerioOptions) => CheerioAPI;
5
+ type CheerioLoader = (document: DocumentBody, options?: CheerioOptions) => CheerioAPI;
6
6
  export declare class InvalidConnectSrc extends Error {
7
7
  constructor();
8
8
  }
package/out/csp/csp-processing-service.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"csp-processing-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-processing-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAS,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI/D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,UAAU,CAAC;AAE7F,aAAK,aAAa,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,UAAU,CAAC;AAEtF,qBAAa,iBAAkB,SAAQ,KAAK;;CAI3C;AAMD,qBAAa,oBAAoB;IAc7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAbhC,OAAO,CAAC,mBAAmB,CAAuB;IAElD,OAAO,CAAC,2BAA2B,CAAqD;IACxF,OAAO,CAAC,6BAA6B,CAAa;IAClD,OAAO,CAAC,oBAAoB,CAAgF;IAE5G,OAAO,CAAC,qBAAqB,CAI3B;gBAEiB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,aAAa,EAAE,aAAa;IAGxC,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,GAAG,UAAU;IAoBvE,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,MAAM,EAAE;IASjF,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,2BAA2B;IAgBnC,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,oBAAoB;CAa7B"}
1
+ {"version":3,"file":"csp-processing-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-processing-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,EAAE,WAAW,EAAS,MAAM,iBAAiB,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAI/D,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,YAAY,EAAuB,MAAM,UAAU,CAAC;AAE7F,KAAK,aAAa,GAAG,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,EAAE,cAAc,KAAK,UAAU,CAAC;AAEtF,qBAAa,iBAAkB,SAAQ,KAAK;;CAI3C;AAMD,qBAAa,oBAAoB;IAc7B,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,aAAa;IAbhC,OAAO,CAAC,mBAAmB,CAAuB;IAElD,OAAO,CAAC,2BAA2B,CAAqD;IACxF,OAAO,CAAC,6BAA6B,CAAa;IAClD,OAAO,CAAC,oBAAoB,CAAgF;IAE5G,OAAO,CAAC,qBAAqB,CAI3B;gBAEiB,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,aAAa,EAAE,aAAa;IAGxC,aAAa,CAAC,IAAI,EAAE,YAAY,EAAE,WAAW,EAAE,WAAW,GAAG,UAAU;IAoBvE,wBAAwB,CAAC,kBAAkB,EAAE,kBAAkB,GAAG,MAAM,EAAE;IASjF,OAAO,CAAC,sBAAsB;IAW9B,OAAO,CAAC,mBAAmB;IAI3B,OAAO,CAAC,2BAA2B;IAgBnC,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,YAAY;IAQpB,OAAO,CAAC,mBAAmB;IAoB3B,OAAO,CAAC,qBAAqB;IAS7B,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IAOvB,OAAO,CAAC,oBAAoB;IAM5B,OAAO,CAAC,mBAAmB;IAW3B,OAAO,CAAC,SAAS;IAIjB,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,oBAAoB;CAa7B"}
package/out/types.d.ts CHANGED
@@ -1,9 +1,7 @@
1
- /// <reference types="node" />
2
- /// <reference types="node" />
3
1
  import type { Permissions } from '@forge/manifest';
4
- export declare type DocumentBody = string | Buffer;
5
- export declare type ContentPermissions = NonNullable<Permissions['content']>;
6
- export declare type ExternalPermissions = NonNullable<Permissions['external']>;
2
+ export type DocumentBody = string | Buffer;
3
+ export type ContentPermissions = NonNullable<Permissions['content']>;
4
+ export type ExternalPermissions = NonNullable<Permissions['external']>;
7
5
  export declare enum ExternalCspType {
8
6
  IMG_SRC = "img-src",
9
7
  MEDIA_SRC = "media-src",
@@ -13,5 +11,5 @@ export declare enum ExternalCspType {
13
11
  FONT_SRC = "font-src",
14
12
  FRAME_SRC = "frame-src"
15
13
  }
16
- export declare type CSPDetails = Record<ExternalCspType, string[]>;
14
+ export type CSPDetails = Record<ExternalCspType, string[]>;
17
15
  //# sourceMappingURL=types.d.ts.map
package/out/types.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":";;AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,oBAAY,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,oBAAY,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AACrE,oBAAY,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AACD,oBAAY,UAAU,GAAG,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC"}
1
+ {"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEnD,MAAM,MAAM,YAAY,GAAG,MAAM,GAAG,MAAM,CAAC;AAE3C,MAAM,MAAM,kBAAkB,GAAG,WAAW,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;AACrE,MAAM,MAAM,mBAAmB,GAAG,WAAW,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,oBAAY,eAAe;IACzB,OAAO,YAAY;IACnB,SAAS,cAAc;IACvB,UAAU,eAAe;IACzB,SAAS,cAAc;IACvB,WAAW,gBAAgB;IAC3B,QAAQ,aAAa;IACrB,SAAS,cAAc;CACxB;AACD,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,eAAe,EAAE,MAAM,EAAE,CAAC,CAAC"}
package/out/types.js CHANGED
@@ -10,4 +10,4 @@ var ExternalCspType;
10
10
  ExternalCspType["CONNECT_SRC"] = "connect-src";
11
11
  ExternalCspType["FONT_SRC"] = "font-src";
12
12
  ExternalCspType["FRAME_SRC"] = "frame-src";
13
- })(ExternalCspType = exports.ExternalCspType || (exports.ExternalCspType = {}));
13
+ })(ExternalCspType || (exports.ExternalCspType = ExternalCspType = {}));
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@forge/csp",
3
- "version": "6.0.0-next.3",
3
+ "version": "6.1.0-next.0",
4
4
  "description": "Contains the CSP configuration for Custom UI resources in Forge",
5
5
  "main": "out/index.js",
6
6
  "author": "Atlassian",
@@ -11,8 +11,8 @@
11
11
  "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
12
12
  },
13
13
  "devDependencies": {
14
- "@forge/cli-shared": "9.0.0-next.7",
15
- "@forge/manifest": "13.0.0-next.2",
14
+ "@forge/cli-shared": "9.0.1-next.8",
15
+ "@forge/manifest": "13.1.0-next.6",
16
16
  "@types/jest": "^29.5.14",
17
17
  "@types/node": "20.19.1",
18
18
  "cheerio": "^1.2.0",