@forge/csp 6.4.1-next.0 → 6.4.1-next.2

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @forge/csp
 
+## 6.4.1-next.2
+
+### Patch Changes
+
+- 49bab87: Add the macro parent host to `frame-ancestors` in the injected CSP for FedRAMP staging and production
+
+## 6.4.1-next.1
+
+### Patch Changes
+
+- 1991376: Include data URLs in font-src. Include Hello Jira domain in frame ancestors if Hello Confluence domain is already included
+
 ## 6.4.1-next.0
 
 ### Patch Changes

package/out/csp/csp-injection-service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AAuO1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAcjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAoCrB,OAAO,CAAC,iBAAiB;IAmFlB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAsGV;CACH"}
+{"version":3,"file":"csp-injection-service.d.ts","sourceRoot":"","sources":["../../src/csp/csp-injection-service.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAE3D,OAAO,EAAE,UAAU,EAAmB,MAAM,UAAU,CAAC;AAEvD,KAAK,iBAAiB,GAAG;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB,CAAC;AAIF,KAAK,oBAAoB,GAAG;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,MAAM,CAAC;CAC3B,CAAC;AAEF,KAAK,SAAS,GAAG,iBAAiB,GAAG,oBAAoB,CAAC;AA+O1D,eAAO,MAAM,qBAAqB,GAAI,WAAW,iBAAiB,EAAE,YAAY,SAAS,KAAG,MAAM,EAcjG,CAAC;AAMF,eAAO,MAAM,kCAAkC,UAAiE,CAAC;AAEjH,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,iBAAiB;IASzB,OAAO,CAAC,qBAAqB;IAI7B,OAAO,CAAC,aAAa;IAoCrB,OAAO,CAAC,iBAAiB;IA6FlB,gBAAgB,GAAI,2JAUxB;QACD,kBAAkB,EAAE,UAAU,CAAC;QAC/B,SAAS,EAAE,iBAAiB,CAAC;QAC7B,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,SAAS,CAAC,EAAE,OAAO,CAAC;QACpB,SAAS,CAAC,EAAE,SAAS,CAAC;QACtB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAChC,KAAG,MAAM,EAAE,CAuGV;CACH"}

package/out/csp/csp-injection-service.js

@@ -137,6 +137,7 @@ const FOS_CDN_STANDARD_HOST = {
 const GCP_FORGE_CDN_HOST = {
     'stg-gcentral': 'https://forge.cdn.stg.atlassian-dev.net'
 };
+const getMacroParentHost = (macroParentHost, env, perimeter = 'commercial') => `${macroParentHost}.cdn.${env}.${perimeter === 'fedramp' ? 'atlassian-dev-us-gov-mod.net' : 'atlassian-dev.net'}`;
 const FOS_CDN_IC_HOST = makeICHosts((env, icOptions) => `https://object-store.${getICDomain(env, icOptions)}`);
 const FOS_CDN_PATH = '/os/ecosystem/installation/';
 const getFOSCDNHost = (microsEnv, icOptions) => {
@@ -202,6 +203,7 @@ class CSPInjectionService {
                 .join(' ');
             const fontSrc = [
                 "'self'",
+                'data:',
                 ...getFOSHostDownload(microsEnv, icOptions),
                 ...fosCDNUrls,
                 ...this.getExistingCSPDetails(types_1.ExternalCspType.FONT_SRC, existingCSPDetails)
@@ -336,14 +338,20 @@ class CSPInjectionService {
                     '*.stg.atlassian.com'
                 ];
                 if (macroParentHost && !localhostWithPortRegex.test(macroParentHost)) {
-                    frameAncestors.push(`${macroParentHost}.cdn.stg.atlassian-dev.net`);
+                    frameAncestors.push(getMacroParentHost(macroParentHost, 'stg'));
                 }
                 break;
             case 'fedramp-stg':
                 frameAncestors = ['*.atlassian-stg-fedm.net'];
+                if (macroParentHost) {
+                    frameAncestors.push(getMacroParentHost(macroParentHost, 'stg', 'fedramp'));
+                }
                 break;
             case 'fedramp-prod':
                 frameAncestors = ['*.atlassian-us-gov-mod.net'];
+                if (macroParentHost) {
+                    frameAncestors.push(getMacroParentHost(macroParentHost, 'prod', 'fedramp'));
+                }
                 break;
             case 'ic-stg':
             case 'ic-prod':
@@ -367,7 +375,7 @@ class CSPInjectionService {
                         frameAncestors.push(`http://${macroParentHost}`);
                     }
                     else {
-                        frameAncestors.push(`${macroParentHost}.cdn.prod.atlassian-dev.net`);
+                        frameAncestors.push(getMacroParentHost(macroParentHost, 'prod'));
                     }
                 }
                 break;
@@ -380,6 +388,9 @@ class CSPInjectionService {
         }
         if (hostname) {
             frameAncestors.push(hostname);
+            if (hostname === 'hello.atlassian.net') {
+                frameAncestors.push('hello.jira.atlassian.cloud');
+            }
         }
         return frameAncestors;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forge/csp",
-  "version": "6.4.1-next.0",
+  "version": "6.4.1-next.2",
   "description": "Contains the CSP configuration for Custom UI resources in Forge",
   "main": "out/index.js",
   "author": "Atlassian",
@@ -11,8 +11,8 @@
     "clean": "rm -rf ./out && rm -f tsconfig.tsbuildinfo"
   },
   "devDependencies": {
-    "@forge/cli-shared": "9.10.0-next.2",
-    "@forge/manifest": "13.8.1-next.1",
+    "@forge/cli-shared": "9.10.0-next.7",
+    "@forge/manifest": "13.9.0-next.5",
     "@types/jest": "^30.0.0",
     "@types/node": "20.19.1",
     "cheerio": "^1.2.0",