@rayselfs/cf-rule-engine 1.9.2 → 1.10.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/behaviors/index.cjs +2 -2
- package/dist/behaviors/index.d.cts +1 -1
- package/dist/behaviors/index.d.ts +1 -1
- package/dist/behaviors/index.js +1 -1
- package/dist/behaviors/set-csp.cjs +2 -2
- package/dist/behaviors/set-csp.d.cts +113 -11
- package/dist/behaviors/set-csp.d.ts +113 -11
- package/dist/behaviors/set-csp.js +1 -1
- package/dist/{chunk-ZXS23HXA.cjs → chunk-PE445VUF.cjs} +7 -1
- package/dist/{chunk-XUI4Y22M.js → chunk-QU32MXNE.js} +7 -1
- package/package.json +1 -1
package/dist/behaviors/index.cjs
CHANGED
|
@@ -4,7 +4,7 @@ var _chunkTJ2POKWDcjs = require('../chunk-TJ2POKWD.cjs');
|
|
|
4
4
|
require('../chunk-YNKZGZ7I.cjs');
|
|
5
5
|
|
|
6
6
|
|
|
7
|
-
var
|
|
7
|
+
var _chunkPE445VUFcjs = require('../chunk-PE445VUF.cjs');
|
|
8
8
|
|
|
9
9
|
|
|
10
10
|
var _chunkPPUHEL4Hcjs = require('../chunk-PPUHEL4H.cjs');
|
|
@@ -124,4 +124,4 @@ function verifyToken(options) {
|
|
|
124
124
|
|
|
125
125
|
|
|
126
126
|
|
|
127
|
-
exports.constructResponse = _chunkOSGZTNTScjs.constructResponse; exports.copyHeader = _chunkJU5WX5RUcjs.copyHeader; exports.directoryIndex = _chunkLTLBEBKLcjs.directoryIndex; exports.imageOptimize = _chunkKXC6ES3Bcjs.imageOptimize; exports.redirect = _chunkWWSRNCUPcjs.redirect; exports.removeResponseHeaders = _chunkSGEBNQR2cjs.removeResponseHeaders; exports.rewriteUri = _chunkBSH5JZBLcjs.rewriteUri; exports.setCacheControl = _chunkCV234DQTcjs.setCacheControl; exports.setCorsHeaders = _chunkTJ2POKWDcjs.setCorsHeaders; exports.setCsp =
|
|
127
|
+
exports.constructResponse = _chunkOSGZTNTScjs.constructResponse; exports.copyHeader = _chunkJU5WX5RUcjs.copyHeader; exports.directoryIndex = _chunkLTLBEBKLcjs.directoryIndex; exports.imageOptimize = _chunkKXC6ES3Bcjs.imageOptimize; exports.redirect = _chunkWWSRNCUPcjs.redirect; exports.removeResponseHeaders = _chunkSGEBNQR2cjs.removeResponseHeaders; exports.rewriteUri = _chunkBSH5JZBLcjs.rewriteUri; exports.setCacheControl = _chunkCV234DQTcjs.setCacheControl; exports.setCorsHeaders = _chunkTJ2POKWDcjs.setCorsHeaders; exports.setCsp = _chunkPE445VUFcjs.setCsp; exports.setRequestHeader = _chunkPPUHEL4Hcjs.setRequestHeader; exports.setResponseHeader = _chunkB4WEJSEZcjs.setResponseHeader; exports.setSecurityHeaders = _chunk3UXNXJ6Ncjs.setSecurityHeaders; exports.stripQueryParams = _chunkMSES76XKcjs.stripQueryParams; exports.verifyToken = verifyToken;
|
|
@@ -8,7 +8,7 @@ export { setResponseHeader } from './set-response-header.cjs';
|
|
|
8
8
|
export { removeResponseHeaders } from './remove-response-headers.cjs';
|
|
9
9
|
export { CorsOptions, setCorsHeaders } from './set-cors-headers.cjs';
|
|
10
10
|
export { stripQueryParams } from './strip-query-params.cjs';
|
|
11
|
-
export { CspOptions, setCsp } from './set-csp.cjs';
|
|
11
|
+
export { CspDirectives, CspOptions, setCsp } from './set-csp.cjs';
|
|
12
12
|
export { setCacheControl } from './set-cache-control.cjs';
|
|
13
13
|
export { SecurityHeadersOptions, setSecurityHeaders } from './set-security-headers.cjs';
|
|
14
14
|
export { ImageOptimizeOptions, ImageOriginConfig, ImageOriginResolver, imageOptimize } from './image-optimize.cjs';
|
|
@@ -8,7 +8,7 @@ export { setResponseHeader } from './set-response-header.js';
|
|
|
8
8
|
export { removeResponseHeaders } from './remove-response-headers.js';
|
|
9
9
|
export { CorsOptions, setCorsHeaders } from './set-cors-headers.js';
|
|
10
10
|
export { stripQueryParams } from './strip-query-params.js';
|
|
11
|
-
export { CspOptions, setCsp } from './set-csp.js';
|
|
11
|
+
export { CspDirectives, CspOptions, setCsp } from './set-csp.js';
|
|
12
12
|
export { setCacheControl } from './set-cache-control.js';
|
|
13
13
|
export { SecurityHeadersOptions, setSecurityHeaders } from './set-security-headers.js';
|
|
14
14
|
export { ImageOptimizeOptions, ImageOriginConfig, ImageOriginResolver, imageOptimize } from './image-optimize.js';
|
package/dist/behaviors/index.js
CHANGED
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
"use strict";Object.defineProperty(exports, "__esModule", {value: true});
|
|
2
2
|
|
|
3
|
-
var
|
|
3
|
+
var _chunkPE445VUFcjs = require('../chunk-PE445VUF.cjs');
|
|
4
4
|
require('../chunk-75ZPJI57.cjs');
|
|
5
5
|
|
|
6
6
|
|
|
7
|
-
exports.setCsp =
|
|
7
|
+
exports.setCsp = _chunkPE445VUFcjs.setCsp;
|
|
@@ -1,27 +1,127 @@
|
|
|
1
1
|
import { ResponseBehaviorFn } from '../core/types.cjs';
|
|
2
2
|
|
|
3
|
+
/**
|
|
4
|
+
* All valid CSP directives with their expected value types.
|
|
5
|
+
*
|
|
6
|
+
* - `string` — directive requires a value, e.g. `'default-src': "'self'"`
|
|
7
|
+
* - `boolean` — value-less flag directive; `true` emits the bare directive name,
|
|
8
|
+
* `false` (or omitted) skips it entirely
|
|
9
|
+
* - `string | boolean` — directive is valid with or without a value (sandbox only)
|
|
10
|
+
*
|
|
11
|
+
* All fields are optional. Omitted fields are not emitted in the header.
|
|
12
|
+
*
|
|
13
|
+
* @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
|
14
|
+
*/
|
|
15
|
+
type CspDirectives = Partial<{
|
|
16
|
+
/** Fallback for all fetch directives not explicitly set. */
|
|
17
|
+
'default-src': string;
|
|
18
|
+
/** Valid sources for Web Workers and nested browsing contexts. */
|
|
19
|
+
'child-src': string;
|
|
20
|
+
/** Valid sources for XMLHttpRequest, WebSocket, EventSource, fetch(). */
|
|
21
|
+
'connect-src': string;
|
|
22
|
+
/** Valid sources for fonts loaded with @font-face. */
|
|
23
|
+
'font-src': string;
|
|
24
|
+
/** Valid sources for nested browsing contexts such as <frame> and <iframe>. */
|
|
25
|
+
'frame-src': string;
|
|
26
|
+
/** Valid sources for images and favicons. */
|
|
27
|
+
'img-src': string;
|
|
28
|
+
/** Valid sources for manifest files. */
|
|
29
|
+
'manifest-src': string;
|
|
30
|
+
/** Valid sources for <audio>, <video>, and <track>. */
|
|
31
|
+
'media-src': string;
|
|
32
|
+
/** Valid sources for <object> and <embed>. */
|
|
33
|
+
'object-src': string;
|
|
34
|
+
/** Valid sources for JavaScript <script> elements. */
|
|
35
|
+
'script-src': string;
|
|
36
|
+
/** Valid sources for inline <script> event handlers. */
|
|
37
|
+
'script-src-attr': string;
|
|
38
|
+
/** Valid sources for JavaScript <script> elements (external files). */
|
|
39
|
+
'script-src-elem': string;
|
|
40
|
+
/** Valid sources for stylesheets. */
|
|
41
|
+
'style-src': string;
|
|
42
|
+
/** Valid sources for inline style attributes. */
|
|
43
|
+
'style-src-attr': string;
|
|
44
|
+
/** Valid sources for <link> stylesheet elements. */
|
|
45
|
+
'style-src-elem': string;
|
|
46
|
+
/** Valid sources for Worker, SharedWorker, and ServiceWorker scripts. */
|
|
47
|
+
'worker-src': string;
|
|
48
|
+
/** Restricts URLs that can be used as the target of a <base> element. */
|
|
49
|
+
'base-uri': string;
|
|
50
|
+
/**
|
|
51
|
+
* Applies sandbox restrictions to the page. Presence alone (`true`) enables
|
|
52
|
+
* the most restrictive sandbox. Pass a string of `allow-*` tokens to relax
|
|
53
|
+
* specific restrictions, e.g. `'allow-scripts allow-same-origin'`.
|
|
54
|
+
*/
|
|
55
|
+
sandbox: string | boolean;
|
|
56
|
+
/** Restricts URLs that can be used as a form action target. */
|
|
57
|
+
'form-action': string;
|
|
58
|
+
/** Restricts which parents may embed this page in a frame. */
|
|
59
|
+
'frame-ancestors': string;
|
|
60
|
+
/** Restricts URLs the document may navigate to. */
|
|
61
|
+
'navigate-to': string;
|
|
62
|
+
/**
|
|
63
|
+
* Restricts creation of Trusted Types policies.
|
|
64
|
+
* Use `'none'` to disallow all policies, or list allowed policy names.
|
|
65
|
+
*/
|
|
66
|
+
'trusted-types': string;
|
|
67
|
+
/**
|
|
68
|
+
* Enforces Trusted Types for a sink group.
|
|
69
|
+
* Common value: `'script'`.
|
|
70
|
+
*/
|
|
71
|
+
'require-trusted-types-for': string;
|
|
72
|
+
/** Reporting group name (defined via `Report-To` header). Preferred over `report-uri`. */
|
|
73
|
+
'report-to': string;
|
|
74
|
+
/**
|
|
75
|
+
* @deprecated Use `report-to` instead. `report-uri` is deprecated but remains
|
|
76
|
+
* widely supported. Include both during transition:
|
|
77
|
+
* `{ 'report-uri': '/csp-report', 'report-to': 'csp-endpoint' }`.
|
|
78
|
+
*/
|
|
79
|
+
'report-uri': string;
|
|
80
|
+
/**
|
|
81
|
+
* Upgrades all insecure HTTP requests to HTTPS before fetching.
|
|
82
|
+
* Set to `true` to emit; `false` or omit to skip.
|
|
83
|
+
*/
|
|
84
|
+
'upgrade-insecure-requests': boolean;
|
|
85
|
+
/**
|
|
86
|
+
* @deprecated Superseded by `upgrade-insecure-requests`. Blocks all mixed
|
|
87
|
+
* content (HTTP resources on HTTPS pages). Set to `true` to emit.
|
|
88
|
+
*/
|
|
89
|
+
'block-all-mixed-content': boolean;
|
|
90
|
+
}>;
|
|
3
91
|
/**
|
|
4
92
|
* Configuration for the `Content-Security-Policy` header.
|
|
5
93
|
*/
|
|
6
94
|
type CspOptions = {
|
|
7
95
|
/**
|
|
8
|
-
* Map of CSP
|
|
9
|
-
*
|
|
10
|
-
*
|
|
96
|
+
* Map of CSP directives to their values. Each entry becomes one segment in
|
|
97
|
+
* the `Content-Security-Policy` header, joined with `'; '`.
|
|
98
|
+
*
|
|
99
|
+
* - String value → `directive value` (e.g. `'img-src': "'self' data:"`)
|
|
100
|
+
* - `true` → `directive` (bare flag, e.g. `'upgrade-insecure-requests': true`)
|
|
101
|
+
* - `false` → skipped (useful for conditional disabling)
|
|
11
102
|
*
|
|
12
103
|
* @example
|
|
13
104
|
* ```ts
|
|
14
|
-
* {
|
|
15
|
-
*
|
|
105
|
+
* {
|
|
106
|
+
* 'default-src': "'self'",
|
|
107
|
+
* 'img-src': "'self' data: https:",
|
|
108
|
+
* 'upgrade-insecure-requests': true,
|
|
109
|
+
* 'frame-ancestors': 'https://*.viverse.com',
|
|
110
|
+
* 'sandbox': 'allow-scripts allow-same-origin',
|
|
111
|
+
* }
|
|
112
|
+
* // → "default-src 'self'; img-src 'self' data: https:; upgrade-insecure-requests; frame-ancestors https://*.viverse.com; sandbox allow-scripts allow-same-origin"
|
|
16
113
|
* ```
|
|
17
114
|
*/
|
|
18
|
-
directives:
|
|
115
|
+
directives: CspDirectives;
|
|
19
116
|
};
|
|
20
117
|
/**
|
|
21
|
-
* Sets the `Content-Security-Policy` response header from a directives map.
|
|
118
|
+
* Sets the `Content-Security-Policy` response header from a typed directives map.
|
|
22
119
|
*
|
|
23
|
-
*
|
|
24
|
-
*
|
|
120
|
+
* - Value directives are emitted as `<directive> <value>`.
|
|
121
|
+
* - Boolean directives (`upgrade-insecure-requests`, `block-all-mixed-content`) are emitted
|
|
122
|
+
* as `<directive>` with no trailing value or space.
|
|
123
|
+
* - Entries are joined with `'; '` to form the final header value.
|
|
124
|
+
* - Overwrites any existing CSP header from the origin.
|
|
25
125
|
*
|
|
26
126
|
* @param options - CSP configuration object containing the `directives` map.
|
|
27
127
|
* @returns A `ResponseBehaviorFn` to use directly in `defineViewerResponse` or wrapped in a `ResponseRule`.
|
|
@@ -29,7 +129,7 @@ type CspOptions = {
|
|
|
29
129
|
* @example
|
|
30
130
|
* ```ts
|
|
31
131
|
* import { setCsp } from '@rayselfs/cf-rule-engine/behaviors'
|
|
32
|
-
* import { defineViewerResponse } from '@rayselfs/cf-rule-engine/adapters/
|
|
132
|
+
* import { defineViewerResponse } from '@rayselfs/cf-rule-engine/adapters/viewer-response'
|
|
33
133
|
*
|
|
34
134
|
* export default defineViewerResponse([
|
|
35
135
|
* setCsp({
|
|
@@ -38,11 +138,13 @@ type CspOptions = {
|
|
|
38
138
|
* 'script-src': "'self' https://cdn.example.com",
|
|
39
139
|
* 'img-src': "'self' data: https:",
|
|
40
140
|
* 'frame-ancestors': "'none'",
|
|
141
|
+
* 'upgrade-insecure-requests': true,
|
|
41
142
|
* },
|
|
42
143
|
* }),
|
|
43
144
|
* ])
|
|
145
|
+
* // → "default-src 'self'; script-src 'self' https://cdn.example.com; img-src 'self' data: https:; frame-ancestors 'none'; upgrade-insecure-requests"
|
|
44
146
|
* ```
|
|
45
147
|
*/
|
|
46
148
|
declare function setCsp(options: CspOptions): ResponseBehaviorFn;
|
|
47
149
|
|
|
48
|
-
export { type CspOptions, setCsp };
|
|
150
|
+
export { type CspDirectives, type CspOptions, setCsp };
|
|
@@ -1,27 +1,127 @@
|
|
|
1
1
|
import { ResponseBehaviorFn } from '../core/types.js';
|
|
2
2
|
|
|
3
|
+
/**
|
|
4
|
+
* All valid CSP directives with their expected value types.
|
|
5
|
+
*
|
|
6
|
+
* - `string` — directive requires a value, e.g. `'default-src': "'self'"`
|
|
7
|
+
* - `boolean` — value-less flag directive; `true` emits the bare directive name,
|
|
8
|
+
* `false` (or omitted) skips it entirely
|
|
9
|
+
* - `string | boolean` — directive is valid with or without a value (sandbox only)
|
|
10
|
+
*
|
|
11
|
+
* All fields are optional. Omitted fields are not emitted in the header.
|
|
12
|
+
*
|
|
13
|
+
* @see https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy
|
|
14
|
+
*/
|
|
15
|
+
type CspDirectives = Partial<{
|
|
16
|
+
/** Fallback for all fetch directives not explicitly set. */
|
|
17
|
+
'default-src': string;
|
|
18
|
+
/** Valid sources for Web Workers and nested browsing contexts. */
|
|
19
|
+
'child-src': string;
|
|
20
|
+
/** Valid sources for XMLHttpRequest, WebSocket, EventSource, fetch(). */
|
|
21
|
+
'connect-src': string;
|
|
22
|
+
/** Valid sources for fonts loaded with @font-face. */
|
|
23
|
+
'font-src': string;
|
|
24
|
+
/** Valid sources for nested browsing contexts such as <frame> and <iframe>. */
|
|
25
|
+
'frame-src': string;
|
|
26
|
+
/** Valid sources for images and favicons. */
|
|
27
|
+
'img-src': string;
|
|
28
|
+
/** Valid sources for manifest files. */
|
|
29
|
+
'manifest-src': string;
|
|
30
|
+
/** Valid sources for <audio>, <video>, and <track>. */
|
|
31
|
+
'media-src': string;
|
|
32
|
+
/** Valid sources for <object> and <embed>. */
|
|
33
|
+
'object-src': string;
|
|
34
|
+
/** Valid sources for JavaScript <script> elements. */
|
|
35
|
+
'script-src': string;
|
|
36
|
+
/** Valid sources for inline <script> event handlers. */
|
|
37
|
+
'script-src-attr': string;
|
|
38
|
+
/** Valid sources for JavaScript <script> elements (external files). */
|
|
39
|
+
'script-src-elem': string;
|
|
40
|
+
/** Valid sources for stylesheets. */
|
|
41
|
+
'style-src': string;
|
|
42
|
+
/** Valid sources for inline style attributes. */
|
|
43
|
+
'style-src-attr': string;
|
|
44
|
+
/** Valid sources for <link> stylesheet elements. */
|
|
45
|
+
'style-src-elem': string;
|
|
46
|
+
/** Valid sources for Worker, SharedWorker, and ServiceWorker scripts. */
|
|
47
|
+
'worker-src': string;
|
|
48
|
+
/** Restricts URLs that can be used as the target of a <base> element. */
|
|
49
|
+
'base-uri': string;
|
|
50
|
+
/**
|
|
51
|
+
* Applies sandbox restrictions to the page. Presence alone (`true`) enables
|
|
52
|
+
* the most restrictive sandbox. Pass a string of `allow-*` tokens to relax
|
|
53
|
+
* specific restrictions, e.g. `'allow-scripts allow-same-origin'`.
|
|
54
|
+
*/
|
|
55
|
+
sandbox: string | boolean;
|
|
56
|
+
/** Restricts URLs that can be used as a form action target. */
|
|
57
|
+
'form-action': string;
|
|
58
|
+
/** Restricts which parents may embed this page in a frame. */
|
|
59
|
+
'frame-ancestors': string;
|
|
60
|
+
/** Restricts URLs the document may navigate to. */
|
|
61
|
+
'navigate-to': string;
|
|
62
|
+
/**
|
|
63
|
+
* Restricts creation of Trusted Types policies.
|
|
64
|
+
* Use `'none'` to disallow all policies, or list allowed policy names.
|
|
65
|
+
*/
|
|
66
|
+
'trusted-types': string;
|
|
67
|
+
/**
|
|
68
|
+
* Enforces Trusted Types for a sink group.
|
|
69
|
+
* Common value: `'script'`.
|
|
70
|
+
*/
|
|
71
|
+
'require-trusted-types-for': string;
|
|
72
|
+
/** Reporting group name (defined via `Report-To` header). Preferred over `report-uri`. */
|
|
73
|
+
'report-to': string;
|
|
74
|
+
/**
|
|
75
|
+
* @deprecated Use `report-to` instead. `report-uri` is deprecated but remains
|
|
76
|
+
* widely supported. Include both during transition:
|
|
77
|
+
* `{ 'report-uri': '/csp-report', 'report-to': 'csp-endpoint' }`.
|
|
78
|
+
*/
|
|
79
|
+
'report-uri': string;
|
|
80
|
+
/**
|
|
81
|
+
* Upgrades all insecure HTTP requests to HTTPS before fetching.
|
|
82
|
+
* Set to `true` to emit; `false` or omit to skip.
|
|
83
|
+
*/
|
|
84
|
+
'upgrade-insecure-requests': boolean;
|
|
85
|
+
/**
|
|
86
|
+
* @deprecated Superseded by `upgrade-insecure-requests`. Blocks all mixed
|
|
87
|
+
* content (HTTP resources on HTTPS pages). Set to `true` to emit.
|
|
88
|
+
*/
|
|
89
|
+
'block-all-mixed-content': boolean;
|
|
90
|
+
}>;
|
|
3
91
|
/**
|
|
4
92
|
* Configuration for the `Content-Security-Policy` header.
|
|
5
93
|
*/
|
|
6
94
|
type CspOptions = {
|
|
7
95
|
/**
|
|
8
|
-
* Map of CSP
|
|
9
|
-
*
|
|
10
|
-
*
|
|
96
|
+
* Map of CSP directives to their values. Each entry becomes one segment in
|
|
97
|
+
* the `Content-Security-Policy` header, joined with `'; '`.
|
|
98
|
+
*
|
|
99
|
+
* - String value → `directive value` (e.g. `'img-src': "'self' data:"`)
|
|
100
|
+
* - `true` → `directive` (bare flag, e.g. `'upgrade-insecure-requests': true`)
|
|
101
|
+
* - `false` → skipped (useful for conditional disabling)
|
|
11
102
|
*
|
|
12
103
|
* @example
|
|
13
104
|
* ```ts
|
|
14
|
-
* {
|
|
15
|
-
*
|
|
105
|
+
* {
|
|
106
|
+
* 'default-src': "'self'",
|
|
107
|
+
* 'img-src': "'self' data: https:",
|
|
108
|
+
* 'upgrade-insecure-requests': true,
|
|
109
|
+
* 'frame-ancestors': 'https://*.viverse.com',
|
|
110
|
+
* 'sandbox': 'allow-scripts allow-same-origin',
|
|
111
|
+
* }
|
|
112
|
+
* // → "default-src 'self'; img-src 'self' data: https:; upgrade-insecure-requests; frame-ancestors https://*.viverse.com; sandbox allow-scripts allow-same-origin"
|
|
16
113
|
* ```
|
|
17
114
|
*/
|
|
18
|
-
directives:
|
|
115
|
+
directives: CspDirectives;
|
|
19
116
|
};
|
|
20
117
|
/**
|
|
21
|
-
* Sets the `Content-Security-Policy` response header from a directives map.
|
|
118
|
+
* Sets the `Content-Security-Policy` response header from a typed directives map.
|
|
22
119
|
*
|
|
23
|
-
*
|
|
24
|
-
*
|
|
120
|
+
* - Value directives are emitted as `<directive> <value>`.
|
|
121
|
+
* - Boolean directives (`upgrade-insecure-requests`, `block-all-mixed-content`) are emitted
|
|
122
|
+
* as `<directive>` with no trailing value or space.
|
|
123
|
+
* - Entries are joined with `'; '` to form the final header value.
|
|
124
|
+
* - Overwrites any existing CSP header from the origin.
|
|
25
125
|
*
|
|
26
126
|
* @param options - CSP configuration object containing the `directives` map.
|
|
27
127
|
* @returns A `ResponseBehaviorFn` to use directly in `defineViewerResponse` or wrapped in a `ResponseRule`.
|
|
@@ -29,7 +129,7 @@ type CspOptions = {
|
|
|
29
129
|
* @example
|
|
30
130
|
* ```ts
|
|
31
131
|
* import { setCsp } from '@rayselfs/cf-rule-engine/behaviors'
|
|
32
|
-
* import { defineViewerResponse } from '@rayselfs/cf-rule-engine/adapters/
|
|
132
|
+
* import { defineViewerResponse } from '@rayselfs/cf-rule-engine/adapters/viewer-response'
|
|
33
133
|
*
|
|
34
134
|
* export default defineViewerResponse([
|
|
35
135
|
* setCsp({
|
|
@@ -38,11 +138,13 @@ type CspOptions = {
|
|
|
38
138
|
* 'script-src': "'self' https://cdn.example.com",
|
|
39
139
|
* 'img-src': "'self' data: https:",
|
|
40
140
|
* 'frame-ancestors': "'none'",
|
|
141
|
+
* 'upgrade-insecure-requests': true,
|
|
41
142
|
* },
|
|
42
143
|
* }),
|
|
43
144
|
* ])
|
|
145
|
+
* // → "default-src 'self'; script-src 'self' https://cdn.example.com; img-src 'self' data: https:; frame-ancestors 'none'; upgrade-insecure-requests"
|
|
44
146
|
* ```
|
|
45
147
|
*/
|
|
46
148
|
declare function setCsp(options: CspOptions): ResponseBehaviorFn;
|
|
47
149
|
|
|
48
|
-
export { type CspOptions, setCsp };
|
|
150
|
+
export { type CspDirectives, type CspOptions, setCsp };
|
|
@@ -3,7 +3,13 @@ function setCsp(options) {
|
|
|
3
3
|
const dirEntries = Object.entries(options.directives);
|
|
4
4
|
const dirParts = [];
|
|
5
5
|
for (let i = 0; i < dirEntries.length; i++) {
|
|
6
|
-
|
|
6
|
+
const key = dirEntries[i][0];
|
|
7
|
+
const val = dirEntries[i][1];
|
|
8
|
+
if (val === true) {
|
|
9
|
+
dirParts.push(key);
|
|
10
|
+
} else if (typeof val === "string") {
|
|
11
|
+
dirParts.push(key + " " + val);
|
|
12
|
+
}
|
|
7
13
|
}
|
|
8
14
|
const cspValue = dirParts.join("; ");
|
|
9
15
|
return (_request, response) => {
|
|
@@ -3,7 +3,13 @@ function setCsp(options) {
|
|
|
3
3
|
const dirEntries = Object.entries(options.directives);
|
|
4
4
|
const dirParts = [];
|
|
5
5
|
for (let i = 0; i < dirEntries.length; i++) {
|
|
6
|
-
|
|
6
|
+
const key = dirEntries[i][0];
|
|
7
|
+
const val = dirEntries[i][1];
|
|
8
|
+
if (val === true) {
|
|
9
|
+
dirParts.push(key);
|
|
10
|
+
} else if (typeof val === "string") {
|
|
11
|
+
dirParts.push(key + " " + val);
|
|
12
|
+
}
|
|
7
13
|
}
|
|
8
14
|
const cspValue = dirParts.join("; ");
|
|
9
15
|
return (_request, response) => {
|