@nestjs/common 11.2.5 → 11.2.6

package/interfaces/http/cookie-options.interface.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Attributes of a `Set-Cookie` header written by `HttpServer.setCookie()` and
+ * `HttpServer.clearCookie()`.
+ *
+ * @see [RFC 6265, section 4.1](https://datatracker.ietf.org/doc/html/rfc6265#section-4.1)
+ *
+ * @publicApi
+ */
+export interface CookieSerializeOptions {
+    /**
+     * `Path` attribute.
+     *
+     * @default '/'
+     */
+    path?: string;
+    /**
+     * `Domain` attribute. Omitted by default, which makes the cookie host-only.
+     */
+    domain?: string;
+    /**
+     * `Max-Age` attribute, in **seconds**, as in RFC 6265 and `@fastify/cookie`.
+     * Must be an integer.
+     *
+     * **Not milliseconds**: Express' `res.cookie()` takes `maxAge` in
+     * milliseconds, so a value carried over from it would make the cookie live
+     * 1000 times longer. For one day, pass `60 * 60 * 24`.
+     */
+    maxAge?: number;
+    /**
+     * `Expires` attribute. Browsers give precedence to `maxAge` when both are
+     * set.
+     */
+    expires?: Date;
+    /**
+     * `HttpOnly` attribute.
+     */
+    httpOnly?: boolean;
+    /**
+     * `Secure` attribute.
+     */
+    secure?: boolean;
+    /**
+     * `SameSite` attribute. `'none'` requires `secure: true`, since browsers
+     * reject `SameSite=None` cookies that are not `Secure`.
+     */
+    sameSite?: 'strict' | 'lax' | 'none';
+    /**
+     * `Partitioned` attribute (CHIPS). Requires `secure: true`, since browsers
+     * reject partitioned cookies that are not `Secure`.
+     */
+    partitioned?: boolean;
+    /**
+     * `Priority` attribute (non-standard, honored by Chromium).
+     */
+    priority?: 'low' | 'medium' | 'high';
+    /**
+     * Whether to sign the value with the first secret configured through the
+     * `cookies.secret` application option. Signed cookies are read with the
+     * `@SignedCookies()` decorator.
+     *
+     * @default false
+     */
+    signed?: boolean;
+}
+/**
+ * The `cookies` option of `NestFactory.create()`.
+ *
+ * @publicApi
+ */
+export interface CookiesOptions {
+    /**
+     * Secret (or secrets) used to sign and verify cookies. When an array is
+     * given, cookies are signed with the first secret and verified against all
+     * of them, which allows rotating secrets without invalidating cookies
+     * signed with a previous one. An empty string, an empty array or an empty
+     * entry throws when the application is created.
+     */
+    secret?: string | string[];
+}

package/interfaces/http/cookie-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/http/csrf-protection-options.interface.d.ts

@@ -0,0 +1,47 @@
+import type { RouteInfo } from '../middleware/middleware-configuration.interface.js';
+/**
+ * Options for `app.enableCsrfProtection()`.
+ *
+ * The protection is based on Fetch Metadata (`Sec-Fetch-Site`) with an
+ * `Origin`/`Host` fallback, following the algorithm of Go's
+ * `net/http.CrossOriginProtection`. It is not a token scheme: it relies on the
+ * browser telling the server where a request comes from, which every
+ * evergreen browser does since 2023.
+ *
+ * Browsers only send `Sec-Fetch-Site` to secure origins (HTTPS or
+ * `localhost`). Otherwise the `Origin` header is compared with the `Host`
+ * header the server receives (`X-Forwarded-Host` is ignored). Behind a proxy
+ * that rewrites `Host`, preserve it, or list the public origin in
+ * `trustedOrigins`.
+ *
+ * @publicApi
+ */
+export interface CsrfProtectionOptions<TRequest = any> {
+    /**
+     * Origins that may send cross-origin, state-changing requests, e.g.
+     * `https://admin.example.com`. Each entry must be a serialized origin:
+     * `scheme://host[:port]`, without a path, query string, fragment or
+     * wildcard. Entries are normalized the way browsers serialize `Origin`
+     * (lower-case, without the default port), and a request is exempt when its
+     * `Origin` header equals one of them.
+     *
+     * Origins allowed by CORS are not trusted implicitly: list them here too.
+     */
+    trustedOrigins?: string[];
+    /**
+     * Requests that skip the protection altogether (for example webhook
+     * endpoints called by third-party servers that send a foreign `Origin`).
+     *
+     * Either a list of routes, or a predicate receiving the platform request
+     * object. Only consulted for requests that would otherwise be rejected.
+     *
+     * Routes are declared like `MiddlewareConsumer.exclude()`: a path, or
+     * `{ path, method, version? }` to narrow by method (and URI version),
+     * without the global prefix, which is added unless the route is excluded
+     * from it. Unlike `exclude()`, the match is exact: case-sensitive, without
+     * an optional trailing slash, and never for non-canonical request paths
+     * (`//`, dot segments, `;`, encoded `/` or `.`), which a router could
+     * resolve to a route that is not excluded.
+     */
+    exclude?: (string | RouteInfo)[] | ((request: TRequest) => boolean);
+}

package/interfaces/http/csrf-protection-options.interface.js

@@ -0,0 +1 @@
+export {};

package/interfaces/http/security-headers-options.interface.d.ts

@@ -0,0 +1,142 @@
+/**
+ * Value of a Content-Security-Policy directive:
+ *
+ * - a string or a list of strings: the directive's source expressions
+ *   (keywords must be quoted, e.g. `"'self'"`);
+ * - `true` or an empty list: a directive without value (e.g.
+ *   `upgrade-insecure-requests`);
+ * - `null` or `false`: removes the directive, including a default one.
+ *
+ * @publicApi
+ */
+export type ContentSecurityPolicyDirectiveValue = string | readonly string[] | boolean | null;
+/**
+ * @publicApi
+ */
+export interface ContentSecurityPolicyOptions {
+    /**
+     * Whether `directives` are merged into the default directives. When
+     * `false`, only `directives` are sent, and they must include `default-src`
+     * (or remove it explicitly with `defaultSrc: null`).
+     *
+     * @default true
+     */
+    useDefaults?: boolean;
+    /**
+     * Directives keyed by name, in camelCase (`scriptSrc`) or kebab-case
+     * (`'script-src'`). A directive given here replaces the default directive
+     * of the same name.
+     */
+    directives?: Record<string, ContentSecurityPolicyDirectiveValue>;
+    /**
+     * Sends `Content-Security-Policy-Report-Only` instead, so violations are
+     * reported (see the `report-to` directive) but not blocked.
+     *
+     * @default false
+     */
+    reportOnly?: boolean;
+}
+/**
+ * Options for `app.useSecurityHeaders()`.
+ *
+ * Each key controls one header and accepts `false` to leave that header out,
+ * `true` for its default value (the same defaults as helmet 8), or an object
+ * to configure it. Option names match helmet's, so existing helmet
+ * configurations carry over, except for helmet's legacy aliases (`hsts`,
+ * `frameguard`, ...). Unknown options are rejected.
+ *
+ * @publicApi
+ */
+export interface SecurityHeadersOptions {
+    /**
+     * `Content-Security-Policy`. Default: `default-src 'self'; base-uri 'self';
+     * font-src 'self' https: data:; form-action 'self'; frame-ancestors 'self';
+     * img-src 'self' data:; object-src 'none'; script-src 'self';
+     * script-src-attr 'none'; style-src 'self' https: 'unsafe-inline';
+     * upgrade-insecure-requests` (serialized without spaces after `;`).
+     */
+    contentSecurityPolicy?: boolean | ContentSecurityPolicyOptions;
+    /**
+     * `Cross-Origin-Embedder-Policy`. Not sent by default; `true` sends
+     * `require-corp`.
+     */
+    crossOriginEmbedderPolicy?: boolean | {
+        policy?: 'require-corp' | 'credentialless' | 'unsafe-none';
+    };
+    /**
+     * `Cross-Origin-Opener-Policy`. Default: `same-origin`.
+     */
+    crossOriginOpenerPolicy?: boolean | {
+        policy?: 'same-origin' | 'same-origin-allow-popups' | 'noopener-allow-popups' | 'unsafe-none';
+    };
+    /**
+     * `Cross-Origin-Resource-Policy`. Default: `same-origin`.
+     */
+    crossOriginResourcePolicy?: boolean | {
+        policy?: 'same-origin' | 'same-site' | 'cross-origin';
+    };
+    /**
+     * `Origin-Agent-Cluster: ?1`.
+     */
+    originAgentCluster?: boolean;
+    /**
+     * `Referrer-Policy`. Default: `no-referrer`. A list is sent as a fallback
+     * chain (the browser uses the last one it supports).
+     */
+    referrerPolicy?: boolean | {
+        policy?: ReferrerPolicyToken | readonly ReferrerPolicyToken[];
+    };
+    /**
+     * `Strict-Transport-Security`. Default: `max-age=31536000;
+     * includeSubDomains`. Browsers ignore it over plain HTTP.
+     */
+    strictTransportSecurity?: boolean | {
+        /** In seconds. @default 31536000 (365 days) */
+        maxAge?: number;
+        /** @default true */
+        includeSubDomains?: boolean;
+        /** @default false */
+        preload?: boolean;
+    };
+    /**
+     * `X-Content-Type-Options: nosniff`.
+     */
+    xContentTypeOptions?: boolean;
+    /**
+     * `X-DNS-Prefetch-Control`. Default: `off`; `{ allow: true }` sends `on`.
+     */
+    xDnsPrefetchControl?: boolean | {
+        allow?: boolean;
+    };
+    /**
+     * `X-Download-Options: noopen`.
+     */
+    xDownloadOptions?: boolean;
+    /**
+     * `X-Frame-Options`. Default: `SAMEORIGIN`. Superseded by the CSP
+     * `frame-ancestors` directive, kept for older browsers.
+     */
+    xFrameOptions?: boolean | {
+        action?: 'deny' | 'sameorigin';
+    };
+    /**
+     * `X-Permitted-Cross-Domain-Policies`. Default: `none`.
+     */
+    xPermittedCrossDomainPolicies?: boolean | {
+        permittedPolicies?: 'none' | 'master-only' | 'by-content-type' | 'all';
+    };
+    /**
+     * Removes the `X-Powered-By` header (on Express, also disables the
+     * `x-powered-by` setting). `false` leaves it untouched.
+     */
+    xPoweredBy?: boolean;
+    /**
+     * `X-XSS-Protection: 0`, which disables the legacy XSS auditor of old
+     * browsers (a source of vulnerabilities itself).
+     */
+    xXssProtection?: boolean;
+}
+/**
+ * @publicApi
+ */
+export type ReferrerPolicyToken = '' | 'no-referrer' | 'no-referrer-when-downgrade' | 'same-origin' | 'origin' | 'strict-origin' | 'origin-when-cross-origin' | 'strict-origin-when-cross-origin' | 'unsafe-url';

package/interfaces/http/security-headers-options.interface.js

@@ -0,0 +1 @@
+export {};

package/internal.d.ts

@@ -25,7 +25,7 @@ export type { MiddlewareConfiguration, RouteInfo, } from './interfaces/middlewar
 export type { MiddlewareConfigProxy } from './interfaces/middleware/middleware-config-proxy.interface.js';
 export type { ModuleMetadata } from './interfaces/modules/module-metadata.interface.js';
 export type { HttpArgumentsHost, RpcArgumentsHost, WsArgumentsHost, } from './interfaces/features/arguments-host.interface.js';
-export type { RequestHandler } from './interfaces/http/http-server.interface.js';
+export type { RequestHandler, SecurityRequestHook, } from './interfaces/http/http-server.interface.js';
 export type { GetOrResolveOptions, SelectOptions, } from './interfaces/nest-application-context.interface.js';
 export type { ShutdownHooksOptions } from './interfaces/shutdown-hooks-options.interface.js';
 export { assignMetadata } from './decorators/http/route-params.decorator.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nestjs/common",
-  "version": "11.2.5",
+  "version": "11.2.6",
   "description": "Nest - modern, fast, powerful node.js web framework (@common)",
   "author": "Kamil Mysliwiec",
   "homepage": "https://nestjs.com",
@@ -38,5 +38,5 @@
       "optional": true
     }
   },
-  "gitHead": "e91618ceec8b2e8fb30ac6277bec07719fdf0f37"
+  "gitHead": "c07cfb0be5e95ffa129da39ccc49a23cb64d49ff"
 }

package/pipes/standard-schema-validation.pipe.js

@@ -61,7 +61,7 @@ let StandardSchemaValidationPipe = class StandardSchemaValidationPipe {
         if (!schema || !this.toValidate(metadata)) {
             return value;
         }
-        stripProtoKeys(value);
+        this.stripProtoKeys(value);
         const result = await this.validate(value, schema, this.validateOptions);
         if (result.issues) {
             throw this.exceptionFactory(result.issues);