@netlify/plugin-csp-nonce 1.2.5 → 1.2.7

package/README.md

@@ -60,7 +60,7 @@ When true, adds `'unsafe-eval'` to the CSP for easier adoption. Set to `false` t
 
 #### `path`
 
-_Default: `"/_"`.\*
+_Default: `"/*"`._
 
 The glob expressions of path(s) that should invoke the CSP nonce edge function. Can be a string or array of strings.
 

package/index.js

@@ -3,10 +3,17 @@ import fs, { copyFileSync } from "fs";
 
 const SITE_ID = "321a7119-6008-49a8-9d2f-e20602b1b349";
 
-export const onPreBuild = async ({ inputs, netlifyConfig, utils }) => {
+export const onPreBuild = async ({
+  inputs,
+  netlifyConfig,
+  utils,
+  constants,
+}) => {
   const config = JSON.stringify(inputs, null, 2);
   const { build } = netlifyConfig;
 
+  const { INTERNAL_EDGE_FUNCTIONS_SRC, INTERNAL_FUNCTIONS_SRC } = constants;
+
   // DISABLE_CSP_NONCE is undocumented (deprecated), but still supported
   // -> superseded by CSP_NONCE_DISTRIBUTION
   if (build.environment.DISABLE_CSP_NONCE === "true") {
@@ -35,25 +42,30 @@ export const onPreBuild = async ({ inputs, netlifyConfig, utils }) => {
       ? "./src"
       : "./node_modules/@netlify/plugin-csp-nonce/src";
 
-  const edgeFunctionsDir = build.edge_functions || "./netlify/edge-functions";
   // make the directory in case it actually doesn't exist yet
-  await utils.run.command(`mkdir -p ${edgeFunctionsDir}`);
-  console.log(`  Writing nonce edge function to ${edgeFunctionsDir}...`);
+  await utils.run.command(`mkdir -p ${INTERNAL_EDGE_FUNCTIONS_SRC}`);
+  console.log(
+    `  Writing nonce edge function to ${INTERNAL_EDGE_FUNCTIONS_SRC}...`,
+  );
   copyFileSync(
     `${basePath}/__csp-nonce.ts`,
-    `${edgeFunctionsDir}/__csp-nonce.ts`
+    `${INTERNAL_EDGE_FUNCTIONS_SRC}/__csp-nonce.ts`,
+  );
+  fs.writeFileSync(
+    `${INTERNAL_EDGE_FUNCTIONS_SRC}/__csp-nonce-inputs.json`,
+    config,
   );
-  fs.writeFileSync(`${edgeFunctionsDir}/__csp-nonce-inputs.json`, config);
 
   // if no reportUri in config input, deploy function on site's behalf
   if (!inputs.reportUri) {
-    const functionsDir = build.functions || "./netlify/functions";
     // make the directory in case it actually doesn't exist yet
-    await utils.run.command(`mkdir -p ${functionsDir}`);
-    console.log(`  Writing violations logging function to ${functionsDir}...`);
+    await utils.run.command(`mkdir -p ${INTERNAL_FUNCTIONS_SRC}`);
+    console.log(
+      `  Writing violations logging function to ${INTERNAL_FUNCTIONS_SRC}...`,
+    );
     copyFileSync(
       `${basePath}/__csp-violations.ts`,
-      `${functionsDir}/__csp-violations.ts`
+      `${INTERNAL_FUNCTIONS_SRC}/__csp-violations.ts`,
     );
   } else {
     console.log(`  Using ${inputs.reportUri} as report-uri directive...`);

package/package.json

@@ -1,7 +1,7 @@
 {
   "private": false,
   "name": "@netlify/plugin-csp-nonce",
-  "version": "1.2.5",
+  "version": "1.2.7",
   "description": "Use a nonce for the script-src and style-src directives of your Content Security Policy.",
   "main": "index.js",
   "repository": {

package/src/__csp-nonce.ts

@@ -90,15 +90,16 @@ const handler = async (request: Request, context: Context) => {
       .map((directive) => {
         // prepend our rules for any existing directives
         const d = directive.trim();
-        if (d.startsWith("script-src")) {
-          return d.replace("script-src", scriptSrc);
+        // intentionally add trailing space to avoid mangling `script-src-elem`
+        if (d.startsWith("script-src ")) {
+          return d.replace("script-src ", scriptSrc);
         }
         // intentionally omit report-uri: theirs should take precedence
         return d;
       })
       .filter(Boolean);
     // push our rules if the directives don't exist yet
-    if (!directives.find((d) => d.startsWith("script-src"))) {
+    if (!directives.find((d) => d.startsWith("script-src "))) {
       directives.push(scriptSrc);
     }
     if (!directives.find((d) => d.startsWith("report-uri"))) {