@netlify/plugin-csp-nonce 1.0.5 → 1.0.7

package/README.md

@@ -7,5 +7,6 @@ This package deploys an edge function to add a header and transform the HTML res
 ## Configuration options
 
 - `reportOnly`: When true, uses the Content-Security-Policy-Report-Only header instead of the Content-Security-Policy header.
+- `unsafeEval`: When true, adds 'unsafe-eval' to CSP for easier adoption. Set to false to have a safer policy if your code and code dependencies does not use eval().
 - `path`: The glob expressions of path(s) that should invoke the CSP nonce edge function. Can be a string or array of strings.
 - `excludedPath`: The glob expressions of path(s) that _should not_ invoke the CSP nonce edge function. Must be an array of strings. This value gets spread with common non-html filetype extensions (_.css, _.js, \*.svg, etc)

package/index.js

@@ -4,9 +4,15 @@ import fs, { copyFileSync } from "fs";
 const SITE_ID = "321a7119-6008-49a8-9d2f-e20602b1b349";
 
 export const onPreBuild = async ({ inputs, netlifyConfig, utils }) => {
-  console.log(`  Current working directory: ${process.cwd()}`);
   const config = JSON.stringify(inputs, null, 2);
   const { build } = netlifyConfig;
+
+  if (build.environment.DISABLE_CSP_NONCE === "true") {
+    console.log(`  DISABLE_CSP_NONCE environment variable is true, skipping.`);
+    return;
+  }
+
+  console.log(`  Current working directory: ${process.cwd()}`);
   const basePath =
     build.environment.SITE_ID === SITE_ID
       ? "./src"

package/manifest.yml

@@ -3,6 +3,9 @@ inputs:
   - name: reportOnly
     description: When true, uses the Content-Security-Policy-Report-Only header instead of the Content-Security-Policy header.
     default: true
+  - name: unsafeEval
+    description: When true, adds 'unsafe-eval' to CSP for easier adoption. Set to false to have a safer policy if your code and code dependencies does not use eval().
+    default: true
   - name: path
     description: The glob expressions of path(s) that should invoke the CSP nonce edge function. Can be a string or array of strings.
     default: "/*"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@netlify/plugin-csp-nonce",
-  "version": "1.0.5",
+  "version": "1.0.7",
   "description": "Use a nonce for the script-src and style-src directives of your Content Security Policy.",
   "main": "index.js",
   "repository": {

package/src/__csp-nonce.ts

@@ -1,13 +1,14 @@
 /* eslint-disable */
 // @ts-expect-error
-import { cryptoRandomString } from "https://deno.land/x/crypto_random_string@1.0.0/mod.ts";
-// @ts-expect-error
 import type { Config, Context } from "netlify:edge";
+// @ts-expect-error
+import { randomBytes } from "node:crypto";
 
 import inputs from "./__csp-nonce-inputs.json" assert { type: "json" };
 
 type Params = {
   reportOnly: boolean;
+  unsafeEval: boolean;
   path: string | string[];
   excludedPath: string[];
 };
@@ -23,23 +24,34 @@ const handler = async (request: Request, context: Context) => {
   // for debugging which routes use this edge function
   response.headers.set("x-debug-csp-nonce", "invoked");
 
-  // html only
-  if (
-    !(
-      request.headers.get("accept")?.startsWith("text/html") &&
-      response.headers.get("content-type").startsWith("text/html")
-    )
-  ) {
+  // html/curl GETs only
+  const isGET = request.method?.toUpperCase() === "GET";
+  const isCurl = request.headers.get("user-agent")?.startsWith("curl/");
+  const isHTMLRequest =
+    request.headers.get("accept")?.startsWith("text/html") || isCurl;
+  const isHTMLResponse = response.headers
+    .get("content-type")
+    .startsWith("text/html");
+  const shouldTransformResponse = isGET && isHTMLRequest && isHTMLResponse;
+  if (!shouldTransformResponse) {
     return response;
   }
 
-  const nonce = cryptoRandomString({ length: 16, type: "alphanumeric" });
+  const nonce = randomBytes(24).toString("base64");
   // `'strict-dynamic'` allows scripts to be loaded from trusted scripts
   // when `'strict-dynamic'` is present, `'unsafe-inline' 'self' https: http:` is ignored by browsers
   // `'unsafe-inline' 'self' https: http:` is a compat check for browsers that don't support `strict-dynamic`
   // https://content-security-policy.com/strict-dynamic/
-  const rules = `'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'self' https: http:`;
-  const scriptSrc = `script-src ${rules}`;
+  const rules = [
+    `'nonce-${nonce}'`,
+    `'strict-dynamic'`,
+    `'unsafe-inline'`,
+    params.unsafeEval && `'unsafe-eval'`,
+    `'self'`,
+    `https:`,
+    `http:`,
+  ].filter(Boolean);
+  const scriptSrc = `script-src ${rules.join(" ")}`;
   const reportUri = `report-uri /.netlify/functions/__csp-violations`;
 
   const csp = response.headers.get(header);
@@ -75,7 +87,7 @@ const handler = async (request: Request, context: Context) => {
   const page = await response.text();
   const rewrittenPage = page.replace(
     /<script([^>]*)>/gi,
-    `<$1 nonce="${nonce}">`
+    `<script$1 nonce="${nonce}">`
   );
   return new Response(rewrittenPage, response);
 };
@@ -136,6 +148,7 @@ export const config: Config = {
   path: params.path,
   excludedPath: [
     ...params.excludedPath,
+    "/.netlify/*",
     ...excludedExtensions.map((ext) => `**/*.${ext}`),
   ],
   handler,