@localnerve/csp-hashes 1.0.1 → 1.1.0

package/dist/index.js

@@ -6,8 +6,19 @@ Object.defineProperty(exports, "__esModule", {
 Object.defineProperty(exports, "default", {
   enumerable: true,
   get: function () {
-    return _index.default;
+    return _index.hashstream;
   }
 });
-var _index = _interopRequireDefault(require("./lib/index.js"));
-function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
+Object.defineProperty(exports, "hashstream", {
+  enumerable: true,
+  get: function () {
+    return _index.hashstream;
+  }
+});
+Object.defineProperty(exports, "removeCspMeta", {
+  enumerable: true,
+  get: function () {
+    return _index.removeCspMeta;
+  }
+});
+var _index = require("./lib/index.js");

package/dist/index.mjs

@@ -8,4 +8,4 @@
  * Licensed under the MIT license.
  */
 /* eslint-env node */
-export { default } from './lib/index.js';
+export { hashstream as default, hashstream, removeCspMeta } from './lib/index.js';

package/dist/lib/index.js

@@ -3,10 +3,17 @@
 Object.defineProperty(exports, "__esModule", {
   value: true
 });
-exports.default = hashstream;
-var _cheerio = _interopRequireDefault(require("cheerio"));
-var _through = _interopRequireDefault(require("through2"));
+exports.default = exports.hashstream = hashstream;
+Object.defineProperty(exports, "removeCspMeta", {
+  enumerable: true,
+  get: function () {
+    return _removeCspMeta.removeCspMeta;
+  }
+});
+var _stream = require("stream");
 var _crypto = _interopRequireDefault(require("crypto"));
+var _cheerio = _interopRequireDefault(require("cheerio"));
+var _removeCspMeta = require("./removeCspMeta.js");
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 /**
  * CSP Hashes.
@@ -69,32 +76,36 @@ function hashstream({
   const createHash = r => _crypto.default.createHash(algo).update(r).digest('base64');
   const formatHash = h => `'${algo}-${h}'`;
   const makeCSPHash = s => formatHash(createHash(s));
-  return _through.default.obj((vinyl, enc, done) => {
-    const path = vinyl.path;
-    const content = vinyl.contents;
-    const hashes = {
-      script: {
-        elements: [],
-        attributes: [],
-        get all() {
-          return this.elements.concat(this.attributes);
-        }
-      },
-      style: {
-        elements: [],
-        attributes: [],
-        get all() {
-          return this.elements.concat(this.attributes);
+  const transformObjectStream = new _stream.Transform({
+    objectMode: true,
+    transform: (vinyl, enc, done) => {
+      const path = vinyl.path;
+      const content = vinyl.contents;
+      const hashes = {
+        script: {
+          elements: [],
+          attributes: [],
+          get all() {
+            return this.elements.concat(this.attributes);
+          }
+        },
+        style: {
+          elements: [],
+          attributes: [],
+          get all() {
+            return this.elements.concat(this.attributes);
+          }
         }
+      };
+      collectHashes(makeCSPHash, content, hashes);
+      if (replace) {
+        const s = callback(path, hashes, content.toString());
+        vinyl.contents = Buffer.from(s, enc);
+      } else {
+        callback(path, hashes);
       }
-    };
-    collectHashes(makeCSPHash, content, hashes);
-    if (replace) {
-      const s = callback(path, hashes, content.toString());
-      vinyl.contents = Buffer.from(s, enc);
-    } else {
-      callback(path, hashes);
+      done(null, vinyl);
     }
-    done(null, vinyl);
   });
+  return transformObjectStream;
 }

package/dist/lib/removeCspMeta.js

@@ -0,0 +1,35 @@
+"use strict";
+
+Object.defineProperty(exports, "__esModule", {
+  value: true
+});
+exports.default = exports.removeCspMeta = removeCspMeta;
+var _stream = require("stream");
+/**
+ * removeCspMeta.js
+ * 
+ * A convenience method to remove the content of a Content-Security-Policy in a meta tag.
+ * Useful for development builds that need to ignore CSP meta tags.
+ * 
+ * Copyright (c) 2022 Alex Grant (@localnerve), LocalNerve LLC
+ * Licensed under the MIT license.
+ */
+
+function removeCspMeta() {
+  return new _stream.Transform({
+    objectMode: true,
+    transform: (vinyl, enc, done) => {
+      var _vinyl$contents;
+      let e = null;
+      const input = vinyl === null || vinyl === void 0 ? void 0 : (_vinyl$contents = vinyl.contents) === null || _vinyl$contents === void 0 ? void 0 : _vinyl$contents.toString();
+      if (input) {
+        const output = input.replace(/("?Content-Security-Policy"?)(\s+)(content=")([^"]+)"/i, '$1$2$3$2"');
+        vinyl.contents = Buffer.from(output, enc);
+      } else {
+        e = new Error('removeCspMeta could not get Vinyl object file contents');
+        e.errorCode = 'EBADINPUT';
+      }
+      done(e, vinyl);
+    }
+  });
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@localnerve/csp-hashes",
-  "version": "1.0.1",
+  "version": "1.1.0",
   "description": "Flexible library to generate CSP hashes",
   "main": "dist/index.js",
   "exports": {
@@ -27,8 +27,7 @@
     "vinyl": "^2.2.1"
   },
   "dependencies": {
-    "cheerio": "^1.0.0-rc.12",
-    "through2": "^4.0.2"
+    "cheerio": "^1.0.0-rc.12"
   },
   "repository": {
     "type": "git",

package/readme.md

@@ -24,7 +24,9 @@ This Nodejs library generates script and style inline element and attribute hash
 + NodeJS 14+
 
 ## API
-This library exports a single function that takes options and returns a transform stream in object mode. The transform stream operates on [Vinyl](https://github.com/gulpjs/vinyl) objects or a compatible file object with `path` and `contents` properties. The only required option is a [`callback`](#callback-function) function.
+
+### hashstream (also the default export)
+This library exports a function that takes options and returns a transform stream in object mode. The transform stream operates on [Vinyl](https://github.com/gulpjs/vinyl) objects or a compatible file object with `path` and `contents` properties. The only required option is a [`callback`](#callback-function) function.
 
 ```
 Stream hashstream ({
@@ -34,6 +36,13 @@ Stream hashstream ({
 })
 ```
 
+### removeCspMeta
+This library also exports a convenience helper method, `removeCspMeta` that is useful for some types of development builds. This method returns a stream that operates on [Vinyl](https://github.com/gulpjs/vinyl) objects and removes any `Content-Security-Policy` content found in the files.
+
+```
+Stream removeCspMeta ()
+```
+
 ### Options
 
 + {Function} **callback** - Required - A [function](#callback-function) to process the hashes. Receives file contents and must return new file contents if `replace` option is true.
@@ -129,6 +138,22 @@ export function cspMetaTags (settings) {
 }
 ```
 
+### Build step to remove CSP Meta tag content
+In this example, a build step removes any content from a `Content-Security-Policy` in a development build that wishes to ignore it.
+
+```javascript
+import gulp from 'gulp';
+import { removeCspMeta } from '@localnerve/csp-hashes';
+
+export function stripCspMetaContents (settings) {
+  const { dist } = settings;
+
+  return gulp.src(`${dist}/**/*.html`)
+    .pipe(removeCspMeta())
+    .pipe(gulp.dest(dist));
+}
+```
+
 ## LICENSE
 
 * [MIT, Alex Grant, LocalNerve, LLC](license.md)