@netlify/plugin-csp-nonce 1.0.3 → 1.0.5

package/index.js

@@ -1,8 +1,8 @@
+/* eslint-disable no-console */
 import fs, { copyFileSync } from "fs";
 
 const SITE_ID = "321a7119-6008-49a8-9d2f-e20602b1b349";
 
-/* eslint-disable no-console */
 export const onPreBuild = async ({ inputs, netlifyConfig, utils }) => {
   console.log(`  Current working directory: ${process.cwd()}`);
   const config = JSON.stringify(inputs, null, 2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netlify/plugin-csp-nonce",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Use a nonce for the script-src and style-src directives of your Content Security Policy.",
   "main": "index.js",
   "repository": {

package/src/__csp-nonce.ts

@@ -1,5 +1,4 @@
-/* eslint-disable import/extensions */
-/* eslint-disable import/no-unresolved */
+/* eslint-disable */
 // @ts-expect-error
 import { cryptoRandomString } from "https://deno.land/x/crypto_random_string@1.0.0/mod.ts";
 // @ts-expect-error
@@ -26,8 +25,10 @@ const handler = async (request: Request, context: Context) => {
 
   // html only
   if (
-    !request.headers.get("accept")?.startsWith("text/html") ||
-    !response.headers.get("content-type").startsWith("text/html")
+    !(
+      request.headers.get("accept")?.startsWith("text/html") &&
+      response.headers.get("content-type").startsWith("text/html")
+    )
   ) {
     return response;
   }
@@ -39,7 +40,6 @@ const handler = async (request: Request, context: Context) => {
   // https://content-security-policy.com/strict-dynamic/
   const rules = `'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'self' https: http:`;
   const scriptSrc = `script-src ${rules}`;
-  const styleSrc = `style-src ${rules}`;
   const reportUri = `report-uri /.netlify/functions/__csp-violations`;
 
   const csp = response.headers.get(header);
@@ -52,9 +52,7 @@ const handler = async (request: Request, context: Context) => {
         if (d.startsWith("script-src")) {
           return d.replace("script-src", scriptSrc);
         }
-        if (d.startsWith("style-src")) {
-          return d.replace("style-src", styleSrc);
-        }
+        // intentionally omit report-uri: theirs should take precedence
         return d;
       })
       .filter(Boolean);
@@ -62,26 +60,27 @@ const handler = async (request: Request, context: Context) => {
     if (!directives.find((d) => d.startsWith("script-src"))) {
       directives.push(scriptSrc);
     }
-    if (!directives.find((d) => d.startsWith("style-src"))) {
-      directives.push(styleSrc);
+    if (!directives.find((d) => d.startsWith("report-uri"))) {
+      directives.push(reportUri);
     }
     const value = directives.join("; ");
     response.headers.set(header, value);
   } else {
     // make a new ruleset of directives if no CSP present
-    const value = [scriptSrc, styleSrc, reportUri].join("; ");
+    const value = [scriptSrc, reportUri].join("; ");
     response.headers.set(header, value);
   }
 
   // time to do some regex magic
   const page = await response.text();
   const rewrittenPage = page.replace(
-    /<(script|style)([^>]*)>/gi,
-    `<$1$2 nonce="${nonce}">`
+    /<script([^>]*)>/gi,
+    `<$1 nonce="${nonce}">`
   );
   return new Response(rewrittenPage, response);
 };
 
+// Top 50 most common extensions (minus .html and .htm) according to Humio
 const excludedExtensions = [
   "aspx",
   "avif",

package/src/__csp-violations.ts

@@ -1,8 +1,8 @@
+/* eslint-disable */
 const handler = async (event) => {
   try {
     const { "csp-report": cspReport } = JSON.parse(event.body);
     if (cspReport) {
-      // eslint-disable-next-line no-console
       console.log(JSON.stringify(cspReport));
     }
   } catch (err) {