@maka/maka-cli 5.123.0 → 5.123.1

package/bundle/typescript/src/templates/meteor/app/server/helmet-csp.js.ts

@@ -1,179 +1,179 @@
-/*
- * Content Security Policy (CSP)
- * https://guide.meteor.com/security.html#httpheaders
- */
-
-/* global __meteor_runtime_config__ */
-import { Meteor } from 'meteor/meteor'
-import { WebApp } from 'meteor/webapp'
-import { Autoupdate } from 'meteor/autoupdate'
-import crypto from 'crypto'
-import type { HelmetOptions } from 'helmet'
-
-const self = '\'self\''
-const data = 'data:'
-const unsafeEval = '\'unsafe-eval\''
-const unsafeInline = '\'unsafe-inline\''
-const allowedOrigins = Meteor.settings.extraAllowedOrigins;
-const devAllowedOrigins = Meteor.settings.devAllowedOrigins;
-
-// create the default connect source for our current domain in
-// a multi-protocol compatible way (http/ws or https/wss)
-const url = Meteor.absoluteUrl()
-const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
-const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
-const usesHttps = s.length > 0
-const connectSrc = [
-  self,
-  `http${s}://${domain}`,
-  `ws${s}://${domain}`
-]
-
-// Prepare runtime config for generating the sha256 hash
-// It is important, that the hash meets exactly the hash of the
-// script in the client bundle.
-// Otherwise the app would not be able to start, since the runtimeConfigScript
-// is rejected __meteor_runtime_config__ is not available, causing
-// a cascade of follow-up errors.
-const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
-  // the following lines may depend on, whether you called Accounts.config
-  // and whether your Meteor app is a "newer" version
-  accountsConfigCalled: true,
-  isModern: true
-})
-
-// add client versions to __meteor_runtime_config__
-// clientProgram is typed `any` here: @types/meteor's WebApp.clientPrograms
-// shape only documents `version` as a plain string, but Meteor's real
-// runtime object also carries the versionRefreshable/versionNonRefreshable/
-// versionReplaceable accessor methods used below.
-Object.keys(WebApp.clientPrograms).forEach(arch => {
-  const clientProgram: any = WebApp.clientPrograms[arch];
-  __meteor_runtime_config__.versions[arch] = {
-    version: Autoupdate.autoupdateVersion || clientProgram.version(),
-    versionRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionRefreshable(),
-    versionNonRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionNonRefreshable(),
-    // comment the following line if you use Meteor < 2.0
-    versionReplaceable: Autoupdate.autoupdateVersion || clientProgram.versionReplaceable()
-  }
-})
-
-const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
-const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
-
-const helmetOptions = {
-  crossOriginOpenerPolicy: { policy: "same-origin-allow-popups" },
-  crossOriginResourcePolicy: true,
-  //If you want to embed something like an iframe, set to false
-  //If this is truu, site's won't be able to link to you
-  crossOriginEmbedderPolicy: false,
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: [self].concat(allowedOrigins),
-      scriptSrc: [
-        self,
-        // Remove / comment out unsafeEval if you do not use dynamic imports
-        // to tighten security. However, if you use dynamic imports this line
-        // must be kept in order to make them work.
-        unsafeEval,
-        `'sha256-${runtimeConfigHash}'`
-      ].concat(allowedOrigins),
-      childSrc: [self].concat(allowedOrigins),
-      // If you have external apps, that should be allowed as sources for
-      // connections or images, your should add them here
-      // Call helmetOptions() without args if you have no external sources
-      // Note, that this is just an example and you may configure this to your needs
-      connectSrc: connectSrc.concat(allowedOrigins),
-      fontSrc: [self, data].concat(allowedOrigins),
-      formAction: [self].concat(allowedOrigins),
-      frameAncestors: [self].concat(allowedOrigins),
-      frameSrc: [self].concat(allowedOrigins),
-      // This is an example to show, that we can define to show images only
-      // from our self, browser data/blob and a defined set of hosts.
-      // Configure to your needs.
-      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
-      manifestSrc: [self].concat(allowedOrigins),
-      mediaSrc: [self].concat(allowedOrigins),
-      objectSrc: [self].concat(allowedOrigins),
-      // these are just examples, configure to your needs, see
-      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
-      sandbox: [
-        // allow-downloads-without-user-activation // experimental
-        'allow-forms',
-        'allow-modals',
-        // 'allow-orientation-lock',
-        // 'allow-pointer-lock',
-        'allow-popups',
-        // 'allow-popups-to-escape-sandbox',
-        // 'allow-presentation',
-        'allow-same-origin',
-        'allow-scripts',
-        // 'allow-storage-access-by-user-activation ', // experimental
-        // 'allow-top-navigation',
-        // 'allow-top-navigation-by-user-activation'
-      ],
-      styleSrc: [self, unsafeInline].concat(allowedOrigins),
-      workerSrc: [self, 'blob:'].concat(allowedOrigins)
-    }
-  },
-  // see the helmet documentation to get a better understanding of
-  // the following configurations and settings
-  strictTransportSecurity: {
-    maxAge: 15552000,
-    includeSubDomains: true,
-    preload: false
-  },
-  referrerPolicy: {
-    policy: 'no-referrer'
-  },
-  frameguard: {
-    action: 'sameorigin'
-  },
-  dnsPrefetchControl: {
-    allow: false
-  },
-  permittedCrossDomainPolicies: {
-    permittedPolicies: 'none'
-  }
-} satisfies HelmetOptions;
-
-// We assume, that we are working on a localhost when there is no https
-// connection available.
-// Run your project with --production flag to simulate script-src hashing
-if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
-  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
-    self,
-    devAllowedOrigins.join(' '),
-    data,
-    unsafeEval,
-    unsafeInline,
-  ];
-
-  helmetOptions.contentSecurityPolicy.directives.styleSrc = [
-    self,
-    devAllowedOrigins.join(' '),
-    data,
-    unsafeEval,
-    unsafeInline,
-  ];
-
-  helmetOptions.contentSecurityPolicy.directives.imgSrc = [
-    self,
-    devAllowedOrigins.join(' '),
-    data,
-    unsafeEval,
-    unsafeInline,
-  ];
-
-    helmetOptions.contentSecurityPolicy.directives.fontSrc = [
-    self,
-    devAllowedOrigins.join(' '),
-    data,
-    unsafeEval,
-    unsafeInline,
-  ];
-
-  (helmetOptions.contentSecurityPolicy.directives as Record<string, any>)['script-src-attr'] = null;
-}
-
-export default helmetOptions;
+/*
+ * Content Security Policy (CSP)
+ * https://guide.meteor.com/security.html#httpheaders
+ */
+
+/* global __meteor_runtime_config__ */
+import { Meteor } from 'meteor/meteor'
+import { WebApp } from 'meteor/webapp'
+import { Autoupdate } from 'meteor/autoupdate'
+import crypto from 'crypto'
+import type { HelmetOptions } from 'helmet'
+
+const self = '\'self\''
+const data = 'data:'
+const unsafeEval = '\'unsafe-eval\''
+const unsafeInline = '\'unsafe-inline\''
+const allowedOrigins = Meteor.settings.extraAllowedOrigins;
+const devAllowedOrigins = Meteor.settings.devAllowedOrigins;
+
+// create the default connect source for our current domain in
+// a multi-protocol compatible way (http/ws or https/wss)
+const url = Meteor.absoluteUrl()
+const domain = url.replace(/http(s)*:\/\//, '').replace(/\/$/, '')
+const s = url.match(/(?!=http)s(?=:\/\/)/) ? 's' : ''
+const usesHttps = s.length > 0
+const connectSrc = [
+  self,
+  `http${s}://${domain}`,
+  `ws${s}://${domain}`
+]
+
+// Prepare runtime config for generating the sha256 hash
+// It is important, that the hash meets exactly the hash of the
+// script in the client bundle.
+// Otherwise the app would not be able to start, since the runtimeConfigScript
+// is rejected __meteor_runtime_config__ is not available, causing
+// a cascade of follow-up errors.
+const runtimeConfig = Object.assign(__meteor_runtime_config__, Autoupdate, {
+  // the following lines may depend on, whether you called Accounts.config
+  // and whether your Meteor app is a "newer" version
+  accountsConfigCalled: true,
+  isModern: true
+})
+
+// add client versions to __meteor_runtime_config__
+// clientProgram is typed `any` here: @types/meteor's WebApp.clientPrograms
+// shape only documents `version` as a plain string, but Meteor's real
+// runtime object also carries the versionRefreshable/versionNonRefreshable/
+// versionReplaceable accessor methods used below.
+Object.keys(WebApp.clientPrograms).forEach(arch => {
+  const clientProgram: any = WebApp.clientPrograms[arch];
+  __meteor_runtime_config__.versions[arch] = {
+    version: Autoupdate.autoupdateVersion || clientProgram.version(),
+    versionRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionRefreshable(),
+    versionNonRefreshable: Autoupdate.autoupdateVersion || clientProgram.versionNonRefreshable(),
+    // comment the following line if you use Meteor < 2.0
+    versionReplaceable: Autoupdate.autoupdateVersion || clientProgram.versionReplaceable()
+  }
+})
+
+const runtimeConfigScript = `__meteor_runtime_config__ = JSON.parse(decodeURIComponent("${encodeURIComponent(JSON.stringify(runtimeConfig))}"))`
+const runtimeConfigHash = crypto.createHash('sha256').update(runtimeConfigScript).digest('base64')
+
+const helmetOptions = {
+  crossOriginOpenerPolicy: { policy: "same-origin-allow-popups" },
+  crossOriginResourcePolicy: true,
+  //If you want to embed something like an iframe, set to false
+  //If this is truu, site's won't be able to link to you
+  crossOriginEmbedderPolicy: false,
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: [self].concat(allowedOrigins),
+      scriptSrc: [
+        self,
+        // Remove / comment out unsafeEval if you do not use dynamic imports
+        // to tighten security. However, if you use dynamic imports this line
+        // must be kept in order to make them work.
+        unsafeEval,
+        `'sha256-${runtimeConfigHash}'`
+      ].concat(allowedOrigins),
+      childSrc: [self].concat(allowedOrigins),
+      // If you have external apps, that should be allowed as sources for
+      // connections or images, your should add them here
+      // Call helmetOptions() without args if you have no external sources
+      // Note, that this is just an example and you may configure this to your needs
+      connectSrc: connectSrc.concat(allowedOrigins),
+      fontSrc: [self, data].concat(allowedOrigins),
+      formAction: [self].concat(allowedOrigins),
+      frameAncestors: [self].concat(allowedOrigins),
+      frameSrc: [self].concat(allowedOrigins),
+      // This is an example to show, that we can define to show images only
+      // from our self, browser data/blob and a defined set of hosts.
+      // Configure to your needs.
+      imgSrc: [self, data, 'blob:'].concat(allowedOrigins),
+      manifestSrc: [self].concat(allowedOrigins),
+      mediaSrc: [self].concat(allowedOrigins),
+      objectSrc: [self].concat(allowedOrigins),
+      // these are just examples, configure to your needs, see
+      // https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/sandbox
+      sandbox: [
+        // allow-downloads-without-user-activation // experimental
+        'allow-forms',
+        'allow-modals',
+        // 'allow-orientation-lock',
+        // 'allow-pointer-lock',
+        'allow-popups',
+        // 'allow-popups-to-escape-sandbox',
+        // 'allow-presentation',
+        'allow-same-origin',
+        'allow-scripts',
+        // 'allow-storage-access-by-user-activation ', // experimental
+        // 'allow-top-navigation',
+        // 'allow-top-navigation-by-user-activation'
+      ],
+      styleSrc: [self, unsafeInline].concat(allowedOrigins),
+      workerSrc: [self, 'blob:'].concat(allowedOrigins)
+    }
+  },
+  // see the helmet documentation to get a better understanding of
+  // the following configurations and settings
+  strictTransportSecurity: {
+    maxAge: 15552000,
+    includeSubDomains: true,
+    preload: false
+  },
+  referrerPolicy: {
+    policy: 'no-referrer'
+  },
+  frameguard: {
+    action: 'sameorigin'
+  },
+  dnsPrefetchControl: {
+    allow: false
+  },
+  permittedCrossDomainPolicies: {
+    permittedPolicies: 'none'
+  }
+} satisfies HelmetOptions;
+
+// We assume, that we are working on a localhost when there is no https
+// connection available.
+// Run your project with --production flag to simulate script-src hashing
+if (!usesHttps && Meteor.isDevelopment && devAllowedOrigins) {
+  helmetOptions.contentSecurityPolicy.directives.scriptSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives.styleSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  helmetOptions.contentSecurityPolicy.directives.imgSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+    helmetOptions.contentSecurityPolicy.directives.fontSrc = [
+    self,
+    devAllowedOrigins.join(' '),
+    data,
+    unsafeEval,
+    unsafeInline,
+  ];
+
+  (helmetOptions.contentSecurityPolicy.directives as Record<string, any>)['script-src-attr'] = null;
+}
+
+export default helmetOptions;