@netlify/plugin-csp-nonce 1.2.1 → 1.2.3

package/package.json

@@ -1,7 +1,7 @@
 {
   "private": false,
   "name": "@netlify/plugin-csp-nonce",
-  "version": "1.2.1",
+  "version": "1.2.3",
   "description": "Use a nonce for the script-src and style-src directives of your Content Security Policy.",
   "main": "index.js",
   "repository": {
@@ -17,13 +17,14 @@
     "src/*"
   ],
   "devDependencies": {
-    "prettier": "^2.8.8"
+    "prettier": "^2.8.8",
+    "typescript": "^5.2.2"
   },
   "bugs": {
     "url": "https://github.com/netlify/plugin-csp-nonce/issues"
   },
   "homepage": "https://github.com/netlify/plugin-csp-nonce#readme",
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "build": "tsc src/*.ts --noEmit --strict --lib es2018,dom"
   }
 }

package/src/__csp-nonce.ts

@@ -1,9 +1,12 @@
 /* eslint-disable */
-// @ts-expect-error
+// @ts-ignore
 import type { Config, Context } from "netlify:edge";
-// @ts-expect-error
+// @ts-ignore
 import { randomBytes } from "node:crypto";
+// @ts-ignore
+import { HTMLRewriter } from "https://ghuc.cc/worker-tools/html-rewriter@0.1.0-pre.17/index.ts";
 
+// @ts-ignore
 import inputs from "./__csp-nonce-inputs.json" assert { type: "json" };
 
 type Params = {
@@ -16,7 +19,7 @@ type Params = {
 const params = inputs as Params;
 
 const handler = async (request: Request, context: Context) => {
-  const response = await context.next();
+  const response = await context.next(request);
 
   let header = params.reportOnly
     ? "content-security-policy-report-only"
@@ -41,7 +44,7 @@ const handler = async (request: Request, context: Context) => {
 
   // CSP_NONCE_DISTRIBUTION is a number from 0 to 1,
   // but 0 to 100 is also supported, along with a trailing %
-  // @ts-expect-error
+  // @ts-ignore
   const distribution = Netlify.env.get("CSP_NONCE_DISTRIBUTION");
   if (!!distribution) {
     const threshold =
@@ -80,7 +83,7 @@ const handler = async (request: Request, context: Context) => {
     params.reportUri || "/.netlify/functions/__csp-violations"
   }`;
 
-  const csp = response.headers.get(header);
+  const csp = response.headers.get(header) as string;
   if (csp) {
     const directives = csp
       .split(";")
@@ -109,13 +112,13 @@ const handler = async (request: Request, context: Context) => {
     response.headers.set(header, value);
   }
 
-  // time to do some regex magic
-  const page = await response.text();
-  const rewrittenPage = page.replace(
-    /<script([^>]*)>/gi,
-    `<script$1 nonce="${nonce}">`
-  );
-  return new Response(rewrittenPage, response);
+  return new HTMLRewriter()
+    .on("script", {
+      element(element: HTMLElement) {
+        element.setAttribute("nonce", nonce);
+      },
+    })
+    .transform(response);
 };
 
 // Top 50 most common extensions (minus .html and .htm) according to Humio
@@ -175,7 +178,7 @@ export const config: Config = {
   excludedPath: [
     ...params.excludedPath,
     "/.netlify/*",
-    ...excludedExtensions.map((ext) => `**/*.${ext}`),
+    `**/*.(${excludedExtensions.join("|")})`,
   ],
   handler,
   onError: "bypass",

package/src/__csp-violations.ts

@@ -1,4 +1,5 @@
 /* eslint-disable */
+// @ts-ignore
 const handler = async (event) => {
   try {
     const { "csp-report": cspReport } = JSON.parse(event.body);