@netlify/plugin-csp-nonce 1.2.13 → 1.3.0

package/index.js

@@ -1,15 +1,24 @@
 /* eslint-disable no-console */
 import fs, { copyFileSync } from "fs";
+import { getBuildInfo } from '@netlify/build-info/node';
 
 const SITE_ID = "321a7119-6008-49a8-9d2f-e20602b1b349";
 
+async function projectUsesNextJS() {
+  for (const framework of (await getBuildInfo()).frameworks) {
+    if (framework.id === 'next') {
+      return true;
+    }
+  }
+  return false;
+}
+
 export const onPreBuild = async ({
   inputs,
   netlifyConfig,
   utils,
   constants,
 }) => {
-  const config = JSON.stringify(inputs, null, 2);
   const { build } = netlifyConfig;
 
   const { INTERNAL_EDGE_FUNCTIONS_SRC, INTERNAL_FUNCTIONS_SRC } = constants;
@@ -51,9 +60,20 @@ export const onPreBuild = async ({
     `${basePath}/__csp-nonce.ts`,
     `${INTERNAL_EDGE_FUNCTIONS_SRC}/__csp-nonce.ts`,
   );
+
+  const usesNext = await projectUsesNextJS();
+
+  // Do not invoke the CSP Edge Function for Netlify Image CDN requests.
+  inputs.excludedPath.push('/.netlify/images');
+  
+  // If using NextJS, do not invoke the CSP Edge Function for NextJS Image requests.
+  if (usesNext) {
+    inputs.excludedPath.push('/_next/image');
+  }
+  
   fs.writeFileSync(
     `${INTERNAL_EDGE_FUNCTIONS_SRC}/__csp-nonce-inputs.json`,
-    config,
+    JSON.stringify(inputs, null, 2),
   );
 
   // if no reportUri in config input, deploy function on site's behalf

package/package.json

@@ -1,7 +1,7 @@
 {
   "private": false,
   "name": "@netlify/plugin-csp-nonce",
-  "version": "1.2.13",
+  "version": "1.3.0",
   "description": "Use a nonce for the script-src and style-src directives of your Content Security Policy.",
   "main": "index.js",
   "repository": {
@@ -26,5 +26,8 @@
   "homepage": "https://github.com/netlify/plugin-csp-nonce#readme",
   "scripts": {
     "build": "tsc src/*.ts --noEmit --strict --lib es2018,dom"
+  },
+  "dependencies": {
+    "@netlify/build-info": "^7.15.2"
   }
 }

package/src/__csp-nonce.ts

@@ -24,8 +24,11 @@ const handler = async (request: Request, context: Context) => {
   // for debugging which routes use this edge function
   response.headers.set("x-debug-csp-nonce", "invoked");
 
-  const isHTMLResponse = response.headers.get("content-type") === "text/html";
-  if (!isHTMLResponse) {
+  const isHTMLResponse = response.headers
+    .get("content-type")
+    ?.startsWith("text/html");
+  const shouldTransformResponse = isHTMLResponse;
+  if (!shouldTransformResponse) {
     console.log(`Unnecessary invocation for ${request.url}`, {
       method: request.method,
       "content-type": response.headers.get("content-type"),