@forge/csp 6.4.0 → 6.4.1-next.1

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @forge/csp
 
+## 6.4.1-next.1
+
+### Patch Changes
+
+- 1991376: Include data URLs in font-src. Include Hello Jira domain in frame ancestors if Hello Confluence domain is already included
+
+## 6.4.1-next.0
+
+### Patch Changes
+
+- 6af1446: Allow Trello (`https://trello.com`, and `https://trellis.coffee` in dev/staging) and the Rovo Chrome extension as `frame-ancestors` in the injected CSP
+
 ## 6.4.0
 
 ### Minor Changes

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAuO1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAcjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAoCrB,OAAO,CAAC,iBAAiB;IA6ElB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAsGV;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAuO1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAcjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAoCrB,OAAO,CAAC,iBAAiB;IAuFlB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAuGV;CACH"}

package/out/csp/csp-injection-service.js

@@ -202,6 +202,7 @@ class CSPInjectionService {
                 .join(' ');
             const fontSrc = [
                 "'self'",
+                'data:',
                 ...getFOSHostDownload(microsEnv, icOptions),
                 ...fosCDNUrls,
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.FONT_SRC, existingCSPDetails)
@@ -330,6 +331,8 @@ class CSPInjectionService {
                     'http://localhost:*',
                     'http://devbucket.localhost',
                     'https://integration.bb-inf.net',
+                    'https://trellis.coffee',
+                    'chrome-extension://npbjhobkibekbklkghlhfhieggcggpdb',
                     '*.atl-paas.net',
                     '*.stg.atlassian.com'
                 ];
@@ -354,6 +357,8 @@ class CSPInjectionService {
                 frameAncestors = [
                     '*.atlassian.net',
                     'bitbucket.org',
+                    'https://trello.com',
+                    'chrome-extension://npbjhobkibekbklkghlhfhieggcggpdb',
                     '*.jira.com',
                     '*.atlassian.com',
                     '*.frontend.public.atl-paas.net'
@@ -376,6 +381,9 @@ class CSPInjectionService {
         }
         if (hostname) {
             frameAncestors.push(hostname);
+            if (hostname === 'hello.atlassian.net') {
+                frameAncestors.push('hello.jira.atlassian.cloud');
+            }
         }
         return frameAncestors;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "6.4.0",
+  "version": "6.4.1-next.1",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,8 +11,8 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "9.9.0",
-    "@forge/manifest": "13.8.0",
+    "@forge/cli-shared": "9.10.0-next.3",
+    "@forge/manifest": "13.9.0-next.2",
     "@types/jest": "^30.0.0",
     "@types/node": "20.19.1",
     "cheerio": "^1.2.0",