@reckona/mreact-router 0.0.204 → 0.0.205
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/csp.d.ts.map +1 -1
- package/dist/csp.js +2 -6
- package/dist/csp.js.map +1 -1
- package/package.json +11 -11
- package/src/csp.ts +3 -11
package/dist/csp.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;CACtD;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CASxE;
|
|
1
|
+
{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAYA,MAAM,WAAW,0BAA0B;IACzC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC3B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;CACtD;AAED,wBAAgB,8BAA8B,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CASxE;AAsCD,wBAAgB,qBAAqB,CACnC,GAAG,EAAE,0BAA0B,GAAG,SAAS,GAC1C,MAAM,GAAG,SAAS,CAoCpB"}
|
package/dist/csp.js
CHANGED
|
@@ -40,11 +40,7 @@ function isValidDirectiveValue(value) {
|
|
|
40
40
|
}
|
|
41
41
|
for (let index = 0; index < value.length; index += 1) {
|
|
42
42
|
const code = value.charCodeAt(index);
|
|
43
|
-
if (code <= 0x20 ||
|
|
44
|
-
code === 0x22 ||
|
|
45
|
-
code === 0x27 ||
|
|
46
|
-
code === 0x3b ||
|
|
47
|
-
code === 0x7f) {
|
|
43
|
+
if (code <= 0x20 || code === 0x22 || code === 0x27 || code === 0x3b || code === 0x7f) {
|
|
48
44
|
return false;
|
|
49
45
|
}
|
|
50
46
|
}
|
|
@@ -74,6 +70,6 @@ export function contentSecurityPolicy(csp) {
|
|
|
74
70
|
}
|
|
75
71
|
serialized.push(`${name} ${values.join(" ")}`);
|
|
76
72
|
}
|
|
77
|
-
return serialized.join("; ");
|
|
73
|
+
return serialized.length === 0 ? undefined : serialized.join("; ");
|
|
78
74
|
}
|
|
79
75
|
//# sourceMappingURL=csp.js.map
|
package/dist/csp.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"csp.js","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,qEAAqE;AACrE,yEAAyE;AAUzE,MAAM,UAAU,8BAA8B,CAAC,OAAgB;IAC7D,KAAK,MAAM,IAAI,IAAI,CAAC,yBAAyB,EAAE,qCAAqC,CAAC,EAAE,CAAC;QACtF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAClD,sEAAsE;AACtE,gEAAgE;AAChE,mEAAmE;AACnE,2BAA2B;AAC3B,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAErC,
|
|
1
|
+
{"version":3,"file":"csp.js","sourceRoot":"","sources":["../src/csp.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,EAAE;AACF,wEAAwE;AACxE,sEAAsE;AACtE,yEAAyE;AACzE,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,qEAAqE;AACrE,yEAAyE;AAUzE,MAAM,UAAU,8BAA8B,CAAC,OAAgB;IAC7D,KAAK,MAAM,IAAI,IAAI,CAAC,yBAAyB,EAAE,qCAAqC,CAAC,EAAE,CAAC;QACtF,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAC1C,MAAM,oBAAoB,GAAG,oBAAoB,CAAC;AAClD,sEAAsE;AACtE,gEAAgE;AAChE,mEAAmE;AACnE,2BAA2B;AAC3B,MAAM,4BAA4B,GAAG,yBAAyB,CAAC;AAE/D,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAY;IACxC,OAAO,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,IAAI,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;QAErC,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;YACrF,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,GAA2C;IAE3C,IAAI,GAAG,EAAE,OAAO,KAAK,IAAI,IAAI,GAAG,EAAE,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CACjB,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,+BAA+B,CAC/E,CAAC;IACJ,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3D,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CAAC,+BAA+B,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7E,CAAC;QAED,MAAM,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAE9D,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;YACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrE,MAAM,IAAI,SAAS,CAAC,mCAAmC,IAAI,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAE9B,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,WAAW,CAAC,EAAE,CAAC;YAC/E,MAAM,CAAC,IAAI,CAAC,UAAU,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;QACtC,CAAC;QAED,UAAU,CAAC,IAAI,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,OAAO,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrE,CAAC","sourcesContent":["// CSP header serializer used by the App Router metadata pipeline.\n//\n// Validates both nonce and directive values before string-concatenating\n// them into the Content-Security-Policy header. Background: directive\n// concatenation with `; ` and quoted-source concatenation with `' '` are\n// trivially escapable if untrusted strings reach the metadata field.\n//\n// Allowed nonce shape: base64 / base64url alphabet only (`+/=` and `-_=`).\n// Allowed directive value shape: no `;`, no quote, no whitespace, no ASCII\n// control characters. Quoted-keyword forms (`'self'`, `'nonce-...'`,\n// `'sha256-...'`, etc.) are accepted via the `'...'` allow-list pattern.\n\nexport interface ContentSecurityPolicyInput {\n disable?: boolean;\n directives?: Record<string, readonly string[] | string>;\n nonce?: string;\n remove?: readonly string[];\n replace?: Record<string, readonly string[] | string>;\n}\n\nexport function responseHeadersContainCspNonce(headers: Headers): boolean {\n for (const name of [\"content-security-policy\", \"content-security-policy-report-only\"]) {\n const value = headers.get(name);\n if (value !== null && /(?:^|[\\s;,])'nonce-[^']+'(?=$|[\\s;,])/i.test(value)) {\n return true;\n }\n }\n\n return false;\n}\n\nconst VALID_NONCE = /^[A-Za-z0-9+/=_-]+$/;\nconst VALID_DIRECTIVE_NAME = /^[a-z][a-z0-9-]*$/i;\n// One CSP \"source expression\". Reject anything containing `;`, quote,\n// whitespace, or ASCII control characters. Quoted keywords like\n// `'self'`, `'unsafe-inline'`, `'nonce-XYZ='` are accepted via the\n// alternate `'...'` shape.\nconst VALID_QUOTED_DIRECTIVE_VALUE = /^'[A-Za-z0-9+/=_:.-]+'$/;\n\nfunction isValidNonce(nonce: string): boolean {\n return VALID_NONCE.test(nonce);\n}\n\nfunction isValidDirectiveName(name: string): boolean {\n return VALID_DIRECTIVE_NAME.test(name);\n}\n\nfunction isValidDirectiveValue(value: string): boolean {\n if (VALID_QUOTED_DIRECTIVE_VALUE.test(value)) {\n return true;\n }\n\n if (value.length === 0) {\n return false;\n }\n\n for (let index = 0; index < value.length; index += 1) {\n const code = value.charCodeAt(index);\n\n if (code <= 0x20 || code === 0x22 || code === 0x27 || code === 0x3b || code === 0x7f) {\n return false;\n }\n }\n\n return true;\n}\n\nexport function contentSecurityPolicy(\n csp: ContentSecurityPolicyInput | undefined,\n): string | undefined {\n if (csp?.disable === true || csp?.directives === undefined) {\n return undefined;\n }\n\n if (csp.nonce !== undefined && !isValidNonce(csp.nonce)) {\n throw new TypeError(\n `invalid CSP nonce: ${JSON.stringify(csp.nonce)} - must be base64 / base64url`,\n );\n }\n\n const serialized: string[] = [];\n\n for (const [name, value] of Object.entries(csp.directives)) {\n if (!isValidDirectiveName(name)) {\n throw new TypeError(`invalid CSP directive name: ${JSON.stringify(name)}`);\n }\n\n const rawValues = Array.isArray(value) ? [...value] : [value];\n\n for (const rawValue of rawValues) {\n if (typeof rawValue !== \"string\" || !isValidDirectiveValue(rawValue)) {\n throw new TypeError(`invalid CSP directive value for ${name}: ${JSON.stringify(rawValue)}`);\n }\n }\n\n const values = [...rawValues];\n\n if (csp.nonce !== undefined && (name === \"script-src\" || name === \"style-src\")) {\n values.push(`'nonce-${csp.nonce}'`);\n }\n\n serialized.push(`${name} ${values.join(\" \")}`);\n }\n\n return serialized.length === 0 ? undefined : serialized.join(\"; \");\n}\n"]}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@reckona/mreact-router",
|
|
3
|
-
"version": "0.0.
|
|
3
|
+
"version": "0.0.205",
|
|
4
4
|
"description": "File-system app router, SSR, actions, and deployment adapters for mreact.",
|
|
5
5
|
"keywords": [
|
|
6
6
|
"jsx",
|
|
@@ -111,20 +111,20 @@
|
|
|
111
111
|
"dependencies": {
|
|
112
112
|
"@typescript/typescript6": "^6.0.2",
|
|
113
113
|
"esbuild": ">=0.28.1 <0.29",
|
|
114
|
-
"@reckona/mreact": "0.0.
|
|
115
|
-
"@reckona/mreact-compat": "0.0.
|
|
116
|
-
"@reckona/mreact-devtools": "0.0.
|
|
117
|
-
"@reckona/mreact-compiler": "0.0.
|
|
118
|
-
"@reckona/mreact-
|
|
119
|
-
"@reckona/mreact-
|
|
120
|
-
"@reckona/mreact-reactive-dom": "0.0.
|
|
121
|
-
"@reckona/mreact-server": "0.0.
|
|
122
|
-
"@reckona/mreact-shared": "0.0.
|
|
114
|
+
"@reckona/mreact": "0.0.205",
|
|
115
|
+
"@reckona/mreact-compat": "0.0.205",
|
|
116
|
+
"@reckona/mreact-devtools": "0.0.205",
|
|
117
|
+
"@reckona/mreact-compiler": "0.0.205",
|
|
118
|
+
"@reckona/mreact-query": "0.0.205",
|
|
119
|
+
"@reckona/mreact-reactive-core": "0.0.205",
|
|
120
|
+
"@reckona/mreact-reactive-dom": "0.0.205",
|
|
121
|
+
"@reckona/mreact-server": "0.0.205",
|
|
122
|
+
"@reckona/mreact-shared": "0.0.205"
|
|
123
123
|
},
|
|
124
124
|
"peerDependencies": {
|
|
125
125
|
"vite": ">=8.1.4 <9"
|
|
126
126
|
},
|
|
127
127
|
"optionalDependencies": {
|
|
128
|
-
"@reckona/mreact-router-native": "0.0.
|
|
128
|
+
"@reckona/mreact-router-native": "0.0.205"
|
|
129
129
|
}
|
|
130
130
|
}
|
package/src/csp.ts
CHANGED
|
@@ -57,13 +57,7 @@ function isValidDirectiveValue(value: string): boolean {
|
|
|
57
57
|
for (let index = 0; index < value.length; index += 1) {
|
|
58
58
|
const code = value.charCodeAt(index);
|
|
59
59
|
|
|
60
|
-
if (
|
|
61
|
-
code <= 0x20 ||
|
|
62
|
-
code === 0x22 ||
|
|
63
|
-
code === 0x27 ||
|
|
64
|
-
code === 0x3b ||
|
|
65
|
-
code === 0x7f
|
|
66
|
-
) {
|
|
60
|
+
if (code <= 0x20 || code === 0x22 || code === 0x27 || code === 0x3b || code === 0x7f) {
|
|
67
61
|
return false;
|
|
68
62
|
}
|
|
69
63
|
}
|
|
@@ -95,9 +89,7 @@ export function contentSecurityPolicy(
|
|
|
95
89
|
|
|
96
90
|
for (const rawValue of rawValues) {
|
|
97
91
|
if (typeof rawValue !== "string" || !isValidDirectiveValue(rawValue)) {
|
|
98
|
-
throw new TypeError(
|
|
99
|
-
`invalid CSP directive value for ${name}: ${JSON.stringify(rawValue)}`,
|
|
100
|
-
);
|
|
92
|
+
throw new TypeError(`invalid CSP directive value for ${name}: ${JSON.stringify(rawValue)}`);
|
|
101
93
|
}
|
|
102
94
|
}
|
|
103
95
|
|
|
@@ -110,5 +102,5 @@ export function contentSecurityPolicy(
|
|
|
110
102
|
serialized.push(`${name} ${values.join(" ")}`);
|
|
111
103
|
}
|
|
112
104
|
|
|
113
|
-
return serialized.join("; ");
|
|
105
|
+
return serialized.length === 0 ? undefined : serialized.join("; ");
|
|
114
106
|
}
|