@localnerve/csp-hashes 8.0.1 → 8.0.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/package.json +3 -3
- package/readme.md +23 -0
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@localnerve/csp-hashes",
|
|
3
|
-
"version": "8.0.
|
|
3
|
+
"version": "8.0.3",
|
|
4
4
|
"description": "Flexible library to generate CSP hashes",
|
|
5
5
|
"main": "index.js",
|
|
6
6
|
"type": "module",
|
|
@@ -15,9 +15,9 @@
|
|
|
15
15
|
},
|
|
16
16
|
"devDependencies": {
|
|
17
17
|
"@eslint/js": "^10.0.1",
|
|
18
|
-
"eslint": "^10.
|
|
18
|
+
"eslint": "^10.10.0",
|
|
19
19
|
"eslint-plugin-n": "^18.3.0",
|
|
20
|
-
"globals": "^17.
|
|
20
|
+
"globals": "^17.12.0",
|
|
21
21
|
"vinyl": "^3.0.1"
|
|
22
22
|
},
|
|
23
23
|
"dependencies": {
|
package/readme.md
CHANGED
|
@@ -25,6 +25,9 @@
|
|
|
25
25
|
- [Build Step to Remove CSP Meta Tag Content](#build-step-to-remove-csp-meta-tag-content)
|
|
26
26
|
- [Native Node.js Streams (No Gulp/Vinyl Required)](#native-nodejs-streams-no-gulpvinyl-required)
|
|
27
27
|
- [Non-ESM usage](#non-esm-usage)
|
|
28
|
+
- [Other CSP Libraries](#other-csp-libraries)
|
|
29
|
+
- [@localnerve/trusted-types-rules](#trusted-types-rules)
|
|
30
|
+
- [@localnerve/trusted-types-bootstrap](#trusted-types-bootstrap)
|
|
28
31
|
- [LICENSE](#license)
|
|
29
32
|
|
|
30
33
|
## Overview
|
|
@@ -298,6 +301,26 @@ import('@localnerve/csp-hashes').then(({ hashstream }) => {
|
|
|
298
301
|
});
|
|
299
302
|
```
|
|
300
303
|
|
|
304
|
+
## Other CSP Libraries
|
|
305
|
+
|
|
306
|
+
See [table](#table-of-csp-libraries) for a summary list of all libraries.
|
|
307
|
+
|
|
308
|
+
### Trusted Types Rules
|
|
309
|
+
Computes Content-Security-Policy `trusted-types` rules and audit injection sinks
|
|
310
|
+
from JavaScript sources, including web components. Derives the
|
|
311
|
+
`trusted-types <policyName>` directive and reports warnings if any new code escapes rules.
|
|
312
|
+
|
|
313
|
+
### Trusted Types Bootstrap
|
|
314
|
+
Detects CSP enforcement and registers an application's trusted types for a page. Boilerplate bootstrap script factored into a tree-shakable library. Small basic utilities included with opt-in to heavier tools like DOMPurify.
|
|
315
|
+
|
|
316
|
+
### Table of CSP Libraries
|
|
317
|
+
|
|
318
|
+
| Package | Scope | Role |
|
|
319
|
+
| --- | --- | --- |
|
|
320
|
+
| [`@localnerve/trusted-types-rules`](https://github.com/localnerve/trusted-types-rules) | build-time audit | Computes the CSP `trusted-types` allowlist from built JS (AST). |
|
|
321
|
+
| [`@localnerve/trusted-types-bootstrap`](https://github.com/localnerve/trusted-types-bootstrap) | app/page-level bootstrap | Registers the app's `default` + named policies, shim, violation logging. One call per app. |
|
|
322
|
+
|
|
323
|
+
|
|
301
324
|
## LICENSE
|
|
302
325
|
|
|
303
326
|
* [MIT, Alex Grant, LocalNerve, LLC](license.md)
|