@hmcts/rpx-xui-node-lib 2.30.7-2541-v2 → 2.30.7-final-new-csp

package/dist/common/util/contentSecurityPolicy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"contentSecurityPolicy.d.ts","sourceRoot":"","sources":["../../../src/common/util/contentSecurityPolicy.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;;;;;;;;;;;;;CAsD3B,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAI,QAAQ,GAAG,QAEnD,CAAA"}
+{"version":3,"file":"contentSecurityPolicy.d.ts","sourceRoot":"","sources":["../../../src/common/util/contentSecurityPolicy.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe;;;;;;;;;;;;;CAmD3B,CAAA;AAED,eAAO,MAAM,wBAAwB,GAAI,QAAQ,GAAG,QAEnD,CAAA"}

package/dist/common/util/contentSecurityPolicy.js

@@ -41,15 +41,12 @@ exports.SECURITY_POLICY = {
         mediaSrc: ["'self'"],
         scriptSrc: [
             "'self'",
-            "'unsafe-inline'",
-            "'unsafe-eval'",
             'https://*.google-analytics.com',
             'https://*.googletagmanager.com',
             'az416426.vo.msecnd.net',
         ],
         styleSrc: [
             "'self'",
-            "'unsafe-inline'",
             'https://fonts.googleapis.com',
             'https://fonts.gstatic.com',
             'https://www.googletagmanager.com',

package/dist/common/util/contentSecurityPolicy.js.map

@@ -1 +1 @@
-{"version":3,"file":"contentSecurityPolicy.js","sourceRoot":"","sources":["../../../src/common/util/contentSecurityPolicy.ts"],"names":[],"mappings":";;;AAAa,QAAA,eAAe,GAAG;IAC3B,UAAU,EAAE;QACR,UAAU,EAAE;YACR,oBAAoB;YACpB,UAAU;YACV,8BAA8B;YAC9B,oBAAoB;YACpB,gCAAgC;YAChC,gCAAgC;YAChC,gCAAgC;YAChC,aAAa;YACb,6BAA6B;YAC7B,+CAA+C;YAC/C,gDAAgD;YAChD,oDAAoD;YACpD,gDAAgD;YAChD,gDAAgD;YAChD,2CAA2C;YAC3C,4CAA4C;YAC5C,6BAA6B;SAChC;QACD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,OAAO,EAAE,CAAC,QAAQ,EAAE,2BAA2B,EAAE,OAAO,CAAC;QACzD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,cAAc,EAAE,CAAC,QAAQ,CAAC;QAC1B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,MAAM,EAAE;YACJ,QAAQ;YACR,OAAO;YACP,gCAAgC;YAChC,gCAAgC;YAChC,0CAA0C;YAC1C,kCAAkC;YAClC,0BAA0B;YAC1B,0BAA0B;YAC1B,2BAA2B;SAC9B;QACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,SAAS,EAAE;YACP,QAAQ;YACR,iBAAiB;YACjB,eAAe;YACf,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;SAC3B;QACD,QAAQ,EAAE;YACN,QAAQ;YACR,iBAAiB;YACjB,8BAA8B;YAC9B,2BAA2B;YAC3B,kCAAkC;SACrC;KACJ;CACJ,CAAA;AAEM,MAAM,wBAAwB,GAAG,CAAC,MAAW,EAAE,EAAE;IACpD,OAAO,MAAM,CAAC,qBAAqB,CAAC,uBAAe,CAAC,CAAA;AACxD,CAAC,CAAA;AAFY,QAAA,wBAAwB,4BAEpC"}
+{"version":3,"file":"contentSecurityPolicy.js","sourceRoot":"","sources":["../../../src/common/util/contentSecurityPolicy.ts"],"names":[],"mappings":";;;AAAa,QAAA,eAAe,GAAG;IAC3B,UAAU,EAAE;QACR,UAAU,EAAE;YACR,oBAAoB;YACpB,UAAU;YACV,8BAA8B;YAC9B,oBAAoB;YACpB,gCAAgC;YAChC,gCAAgC;YAChC,gCAAgC;YAChC,aAAa;YACb,6BAA6B;YAC7B,+CAA+C;YAC/C,gDAAgD;YAChD,oDAAoD;YACpD,gDAAgD;YAChD,gDAAgD;YAChD,2CAA2C;YAC3C,4CAA4C;YAC5C,6BAA6B;SAChC;QACD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,OAAO,EAAE,CAAC,QAAQ,EAAE,2BAA2B,EAAE,OAAO,CAAC;QACzD,UAAU,EAAE,CAAC,QAAQ,CAAC;QACtB,cAAc,EAAE,CAAC,QAAQ,CAAC;QAC1B,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,MAAM,EAAE;YACJ,QAAQ;YACR,OAAO;YACP,gCAAgC;YAChC,gCAAgC;YAChC,0CAA0C;YAC1C,kCAAkC;YAClC,0BAA0B;YAC1B,0BAA0B;YAC1B,2BAA2B;SAC9B;QACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,SAAS,EAAE;YACP,QAAQ;YACR,gCAAgC;YAChC,gCAAgC;YAChC,wBAAwB;SAC3B;QACD,QAAQ,EAAE;YACN,QAAQ;YACR,8BAA8B;YAC9B,2BAA2B;YAC3B,kCAAkC;SACrC;KACJ;CACJ,CAAA;AAEM,MAAM,wBAAwB,GAAG,CAAC,MAAW,EAAE,EAAE;IACpD,OAAO,MAAM,CAAC,qBAAqB,CAAC,uBAAe,CAAC,CAAA;AACxD,CAAC,CAAA;AAFY,QAAA,wBAAwB,4BAEpC"}

package/dist/common/util/csp.d.ts

@@ -0,0 +1,10 @@
+import { Request, Response, NextFunction } from 'express';
+export declare function csp({ extraScript, extraStyle, extraConnect, extraFont, extraImg, defaultCsp }?: {
+    extraScript?: string[] | undefined;
+    extraStyle?: string[] | undefined;
+    extraConnect?: string[] | undefined;
+    extraFont?: string[] | undefined;
+    extraImg?: string[] | undefined;
+    defaultCsp?: {} | undefined;
+}): (req: Request, res: Response, next: NextFunction) => void;
+//# sourceMappingURL=csp.d.ts.map

package/dist/common/util/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../../src/common/util/csp.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAK1D,wBAAgB,GAAG,CAAC,EAClB,WAA6E,EAC7E,UAA2E,EAC3E,YAA+E,EAC/E,SAAyE,EACzE,QAAuE,EACvE,UAAe,EAChB;;;;;;;CAAK,IACI,KAAK,OAAO,EAAE,KAAK,QAAQ,EAAE,MAAM,YAAY,UAoCxD"}

package/dist/common/util/csp.js

@@ -0,0 +1,43 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.csp = csp;
+const helmet_1 = __importDefault(require("helmet"));
+const node_crypto_1 = __importDefault(require("node:crypto"));
+const deepmerge_1 = __importDefault(require("deepmerge"));
+function csp(_a) {
+    var _b, _c, _d, _e, _f;
+    var { extraScript = ((_b = process.env.CSP_SCRIPT_EXTRA) !== null && _b !== void 0 ? _b : '').split(',').filter(Boolean), extraStyle = ((_c = process.env.CSP_STYLE_EXTRA) !== null && _c !== void 0 ? _c : '').split(',').filter(Boolean), extraConnect = ((_d = process.env.CSP_CONNECT_EXTRA) !== null && _d !== void 0 ? _d : '').split(',').filter(Boolean), extraFont = ((_e = process.env.CSP_FONT_EXTRA) !== null && _e !== void 0 ? _e : '').split(',').filter(Boolean), extraImg = ((_f = process.env.CSP_IMG_EXTRA) !== null && _f !== void 0 ? _f : '').split(',').filter(Boolean), defaultCsp = {} } = _a === void 0 ? {} : _a;
+    return (req, res, next) => {
+        const nonce = node_crypto_1.default.randomBytes(16).toString('base64');
+        res.locals.cspNonce = nonce;
+        const newCsp = {
+            useDefaults: true,
+            directives: {
+                // dashed form is fine too, but keep the SAME spelling everywhere
+                defaultSrc: ["'self'"],
+                scriptSrc: ["'self'", `'nonce-${nonce}'`, ...extraScript],
+                styleSrc: ["'self'", `'nonce-${nonce}'`, ...extraStyle],
+                /* THIS authorises inline *attribute* styles */
+                styleSrcAttr: ["'unsafe-inline'"],
+                /* THIS authorises inline scripts such as javascript:void(0) */
+                /* TODO: this should be removed in future via replacing such lines in common-lib and toolkit */
+                scriptSrcAttr: ["'unsafe-inline'"],
+                connectSrc: ["'self'", "blob:", "data:", ...extraConnect],
+                imgSrc: ["'self'", "data:", ...extraImg],
+                fontSrc: ["'self'", "data:", "https://fonts.gstatic.com", ...extraFont],
+                objectSrc: ["'none'"],
+                frameSrc: ["'self'"],
+                frameAncestors: ["'self'"],
+                formAction: ["'none'"]
+            },
+            reportOnly: process.env.CSP_REPORT_ONLY === 'true'
+        };
+        // deep‑merge so we don’t lose anything from SECURITY_POLICY
+        const finalCsp = (0, deepmerge_1.default)(defaultCsp, newCsp);
+        helmet_1.default.contentSecurityPolicy(finalCsp)(req, res, next);
+    };
+}
+//# sourceMappingURL=csp.js.map

package/dist/common/util/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../../src/common/util/csp.ts"],"names":[],"mappings":";;;;;AAKA,kBA4CC;AAhDD,oDAA4B;AAC5B,8DAAiC;AACjC,0DAA8B;AAE9B,SAAgB,GAAG,CAAC,EAOd;;QAPc,EAClB,WAAW,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,gBAAgB,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAC7E,UAAU,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,eAAe,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAC3E,YAAY,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,iBAAiB,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAC/E,SAAS,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,cAAc,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EACzE,QAAQ,GAAG,CAAC,MAAA,OAAO,CAAC,GAAG,CAAC,aAAa,mCAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EACvE,UAAU,GAAG,EAAE,EAChB,mBAAG,EAAE;IACJ,OAAO,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QACzD,MAAM,KAAK,GAAG,qBAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QACxD,GAAG,CAAC,MAAM,CAAC,QAAQ,GAAG,KAAK,CAAC;QAE5B,MAAM,MAAM,GAAG;YACb,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE;gBACV,iEAAiE;gBACjE,UAAU,EAAE,CAAC,QAAQ,CAAC;gBACtB,SAAS,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG,EAAE,GAAG,WAAW,CAAC;gBACzD,QAAQ,EAAE,CAAC,QAAQ,EAAE,UAAU,KAAK,GAAG,EAAE,GAAG,UAAU,CAAC;gBAEvD,+CAA+C;gBAC/C,YAAY,EAAE,CAAC,iBAAiB,CAAC;gBAEjC,+DAA+D;gBAC/D,+FAA+F;gBAC/F,aAAa,EAAE,CAAC,iBAAiB,CAAC;gBAElC,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC;gBACzD,MAAM,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;gBACxC,OAAO,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,2BAA2B,EAAE,GAAG,SAAS,CAAC;gBAEvE,SAAS,EAAE,CAAC,QAAQ,CAAC;gBACrB,QAAQ,EAAE,CAAC,QAAQ,CAAC;gBACpB,cAAc,EAAE,CAAC,QAAQ,CAAC;gBAC1B,UAAU,EAAE,CAAC,QAAQ,CAAC;aACvB;YACD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,MAAM;SACnD,CAAC;QAEF,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,IAAA,mBAAK,EAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAE3C,gBAAM,CAAC,qBAAqB,CAAC,QAAQ,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACzD,CAAC,CAAC;AACJ,CAAC"}

package/dist/common/util/index.d.ts

@@ -1,3 +1,5 @@
+export { SECURITY_POLICY } from './contentSecurityPolicy';
+export { csp } from './csp';
 export { hasKey } from './hasKey';
 export { getLogger, XuiLogger } from './debug.logger';
 export { getContentSecurityPolicy } from './contentSecurityPolicy';

package/dist/common/util/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/util/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/common/util/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,GAAG,EAAE,MAAM,OAAO,CAAA;AAC3B,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAA;AACjC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAA;AACrD,OAAO,EAAE,wBAAwB,EAAE,MAAM,yBAAyB,CAAA;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAA;AACvD,OAAO,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,MAAM,eAAe,CAAA"}

package/dist/common/util/index.js

@@ -1,12 +1,16 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.getUserSessionTimeout = exports.arrayPatternMatch = exports.isStringPatternMatch = exports.sortArray = exports.getContentSecurityPolicy = exports.getLogger = exports.hasKey = void 0;
+exports.getUserSessionTimeout = exports.arrayPatternMatch = exports.isStringPatternMatch = exports.sortArray = exports.getContentSecurityPolicy = exports.getLogger = exports.hasKey = exports.csp = exports.SECURITY_POLICY = void 0;
+var contentSecurityPolicy_1 = require("./contentSecurityPolicy");
+Object.defineProperty(exports, "SECURITY_POLICY", { enumerable: true, get: function () { return contentSecurityPolicy_1.SECURITY_POLICY; } });
+var csp_1 = require("./csp");
+Object.defineProperty(exports, "csp", { enumerable: true, get: function () { return csp_1.csp; } });
 var hasKey_1 = require("./hasKey");
 Object.defineProperty(exports, "hasKey", { enumerable: true, get: function () { return hasKey_1.hasKey; } });
 var debug_logger_1 = require("./debug.logger");
 Object.defineProperty(exports, "getLogger", { enumerable: true, get: function () { return debug_logger_1.getLogger; } });
-var contentSecurityPolicy_1 = require("./contentSecurityPolicy");
-Object.defineProperty(exports, "getContentSecurityPolicy", { enumerable: true, get: function () { return contentSecurityPolicy_1.getContentSecurityPolicy; } });
+var contentSecurityPolicy_2 = require("./contentSecurityPolicy");
+Object.defineProperty(exports, "getContentSecurityPolicy", { enumerable: true, get: function () { return contentSecurityPolicy_2.getContentSecurityPolicy; } });
 var sortArray_1 = require("./sortArray");
 Object.defineProperty(exports, "sortArray", { enumerable: true, get: function () { return sortArray_1.sortArray; } });
 var stringPatternMatch_1 = require("./stringPatternMatch");

package/dist/common/util/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/util/index.ts"],"names":[],"mappings":";;;AAAA,mCAAiC;AAAxB,gGAAA,MAAM,OAAA;AACf,+CAAqD;AAA5C,yGAAA,SAAS,OAAA;AAClB,iEAAkE;AAAzD,iIAAA,wBAAwB,OAAA;AACjC,yCAAuC;AAA9B,sGAAA,SAAS,OAAA;AAClB,2DAA2D;AAAlD,0HAAA,oBAAoB,OAAA;AAC7B,yDAAuD;AAA9C,sHAAA,iBAAiB,OAAA;AAC1B,6CAA8E;AAArE,oHAAA,qBAAqB,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/common/util/index.ts"],"names":[],"mappings":";;;AAAA,iEAA0D;AAAjD,wHAAA,eAAe,OAAA;AACxB,6BAA2B;AAAlB,0FAAA,GAAG,OAAA;AACZ,mCAAiC;AAAxB,gGAAA,MAAM,OAAA;AACf,+CAAqD;AAA5C,yGAAA,SAAS,OAAA;AAClB,iEAAkE;AAAzD,iIAAA,wBAAwB,OAAA;AACjC,yCAAuC;AAA9B,sGAAA,SAAS,OAAA;AAClB,2DAA2D;AAAlD,0HAAA,oBAAoB,OAAA;AAC7B,yDAAuD;AAA9C,sHAAA,iBAAiB,OAAA;AAC1B,6CAA8E;AAArE,oHAAA,qBAAqB,OAAA"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmcts/rpx-xui-node-lib",
-  "version": "2.30.7-2541-v2",
+  "version": "2.30.7-final-new-csp",
   "description": "Common nodejs library components for XUI",
   "main": "dist/index",
   "types": "dist/index.d.ts",
@@ -40,6 +40,9 @@
   "files": [
     "dist/**/*"
   ],
+  "peerDependencies": {
+    "helmet": "^7.0.0"
+  },
   "devDependencies": {
     "@commitlint/cli": "^17.8.1",
     "@commitlint/config-conventional": "^8.2.0",
@@ -64,6 +67,7 @@
     "commitlint-config-cz": "^0.13.1",
     "cz-conventional-changelog": "^3.3.0",
     "eslint": "^9.25.1",
+    "helmet": "^7.0.0",
     "husky": "^8.0.0",
     "jest": "^29.7.0",
     "jest-config": "29.5.0",