@sitecore-jss/sitecore-jss-nextjs 22.1.0-canary.12 → 22.1.0-canary.13

package/dist/cjs/editing/constants.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.QUERY_PARAM_PROTECTION_BYPASS_VERCEL = exports.QUERY_PARAM_PROTECTION_BYPASS_SITECORE = exports.QUERY_PARAM_EDITING_SECRET = void 0;
+exports.EDITING_ALLOWED_ORIGINS = exports.QUERY_PARAM_PROTECTION_BYPASS_VERCEL = exports.QUERY_PARAM_PROTECTION_BYPASS_SITECORE = exports.QUERY_PARAM_EDITING_SECRET = void 0;
 exports.QUERY_PARAM_EDITING_SECRET = 'secret';
 exports.QUERY_PARAM_PROTECTION_BYPASS_SITECORE = 'x-sitecore-protection-bypass';
 exports.QUERY_PARAM_PROTECTION_BYPASS_VERCEL = 'x-vercel-protection-bypass';
+exports.EDITING_ALLOWED_ORIGINS = ['https://pages*.cloud/', 'https://pages.sitecorecloud.io/'];

package/dist/cjs/editing/editing-config-middleware.js

@@ -13,6 +13,7 @@ exports.EditingConfigMiddleware = void 0;
 const constants_1 = require("./constants");
 const utils_1 = require("../utils/utils");
 const sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
 /**
  * Middleware / handler used in the editing config API route in xmcloud add on (e.g. '/api/editing/config')
  * provides configuration information to determine feature compatibility on Pages side.
@@ -25,6 +26,10 @@ class EditingConfigMiddleware {
         this.config = config;
         this.handler = (_req, res) => __awaiter(this, void 0, void 0, function* () {
             const secret = _req.query[constants_1.QUERY_PARAM_EDITING_SECRET];
+            if (!(0, utils_2.enforceCors)(_req, res, constants_1.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             if (secret !== (0, utils_1.getJssEditingSecret)()) {
                 sitecore_jss_1.debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, (0, utils_1.getJssEditingSecret)());
                 return res.status(401).json({ message: 'Missing or invalid editing secret' });

package/dist/cjs/editing/editing-data-middleware.js

@@ -14,6 +14,8 @@ const editing_data_cache_1 = require("./editing-data-cache");
 const editing_data_1 = require("./editing-data");
 const constants_1 = require("./constants");
 const utils_1 = require("../utils/utils");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
+const sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
 /**
  * Middleware / handler for use in the editing data Next.js API dynamic route (e.g. '/api/editing/data/[key]')
  * which is required for Sitecore editing support.
@@ -28,6 +30,10 @@ class EditingDataMiddleware {
             const { method, query, body } = req;
             const secret = query[constants_1.QUERY_PARAM_EDITING_SECRET];
             const key = query[this.queryParamKey];
+            if (!(0, utils_2.enforceCors)(req, res, constants_1.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             // Validate secret
             if (secret !== (0, utils_1.getJssEditingSecret)()) {
                 res.status(401).end('Missing or invalid secret');

package/dist/cjs/editing/editing-render-middleware.js

@@ -18,6 +18,7 @@ const editing_data_service_1 = require("./editing-data-service");
 const constants_2 = require("./constants");
 const utils_1 = require("../utils/utils");
 const render_middleware_1 = require("./render-middleware");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
 /**
  * Middleware / handler for use in the editing render Next.js API route (e.g. '/api/editing/render')
  * which is required for Sitecore editing support.
@@ -30,7 +31,7 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
         var _a, _b, _c, _d;
         super();
         this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
-            var _e, _f;
+            var _e, _f, _g;
             const { method, query, body, headers } = req;
             const startTimestamp = Date.now();
             sitecore_jss_1.debug.editing('editing render middleware start: %o', {
@@ -39,6 +40,12 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 headers,
                 body,
             });
+            if (!(0, utils_2.enforceCors)(req, res, constants_2.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({
+                    html: `<html><body>Requests from origin ${(_e = req.headers) === null || _e === void 0 ? void 0 : _e.origin} not allowed</body></html>`,
+                });
+            }
             if (method !== 'POST') {
                 sitecore_jss_1.debug.editing('invalid method - sent %s expected POST', method);
                 res.setHeader('Allow', 'POST');
@@ -47,7 +54,7 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 });
             }
             // Validate secret
-            const secret = (_e = query[constants_2.QUERY_PARAM_EDITING_SECRET]) !== null && _e !== void 0 ? _e : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
+            const secret = (_f = query[constants_2.QUERY_PARAM_EDITING_SECRET]) !== null && _f !== void 0 ? _f : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
             if (secret !== (0, utils_1.getJssEditingSecret)()) {
                 sitecore_jss_1.debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, (0, utils_1.getJssEditingSecret)());
                 return res.status(401).json({
@@ -109,7 +116,7 @@ class EditingRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 html = html.replace(constants_1.STATIC_PROPS_ID, constants_1.SERVER_PROPS_ID);
                 if (editingData.layoutData.sitecore.context.renderingType === layout_1.RenderingType.Component) {
                     // Handle component rendering. Extract component markup only
-                    html = (_f = (0, node_html_parser_1.parse)(html).getElementById(layout_1.EDITING_COMPONENT_ID)) === null || _f === void 0 ? void 0 : _f.innerHTML;
+                    html = (_g = (0, node_html_parser_1.parse)(html).getElementById(layout_1.EDITING_COMPONENT_ID)) === null || _g === void 0 ? void 0 : _g.innerHTML;
                     if (!html)
                         throw new Error(`Failed to render component for ${editingData.path}`);
                 }

package/dist/cjs/editing/feaas-render-middleware.js

@@ -14,6 +14,7 @@ const sitecore_jss_1 = require("@sitecore-jss/sitecore-jss");
 const constants_1 = require("./constants");
 const utils_1 = require("../utils/utils");
 const render_middleware_1 = require("./render-middleware");
+const utils_2 = require("@sitecore-jss/sitecore-jss/utils");
 /**
  * Middleware / handler for use in the feaas render Next.js API route (e.g. '/api/editing/feaas/render')
  * which is required for Sitecore editing support.
@@ -28,6 +29,7 @@ class FEAASRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
         this.config = config;
         this.defaultPageUrl = '/feaas/render';
         this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _b;
             const { method, query, headers } = req;
             const startTimestamp = Date.now();
             sitecore_jss_1.debug.editing('feaas render middleware start: %o', {
@@ -35,6 +37,12 @@ class FEAASRenderMiddleware extends render_middleware_1.RenderMiddlewareBase {
                 query,
                 headers,
             });
+            if (!(0, utils_2.enforceCors)(req, res, constants_1.EDITING_ALLOWED_ORIGINS)) {
+                sitecore_jss_1.debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res
+                    .status(401)
+                    .send(`<html><body>Requests from origin ${(_b = req.headers) === null || _b === void 0 ? void 0 : _b.origin} are not allowed</body></html>`);
+            }
             if (method !== 'GET') {
                 sitecore_jss_1.debug.editing('invalid method - sent %s expected GET', method);
                 res.setHeader('Allow', 'GET');

package/dist/esm/editing/constants.js

@@ -1,3 +1,4 @@
 export const QUERY_PARAM_EDITING_SECRET = 'secret';
 export const QUERY_PARAM_PROTECTION_BYPASS_SITECORE = 'x-sitecore-protection-bypass';
 export const QUERY_PARAM_PROTECTION_BYPASS_VERCEL = 'x-vercel-protection-bypass';
+export const EDITING_ALLOWED_ORIGINS = ['https://pages*.cloud/', 'https://pages.sitecorecloud.io/'];

package/dist/esm/editing/editing-config-middleware.js

@@ -7,9 +7,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
         step((generator = generator.apply(thisArg, _arguments || [])).next());
     });
 };
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
 import { debug } from '@sitecore-jss/sitecore-jss';
+import { enforceCors } from '@sitecore-jss/sitecore-jss/utils';
 /**
  * Middleware / handler used in the editing config API route in xmcloud add on (e.g. '/api/editing/config')
  * provides configuration information to determine feature compatibility on Pages side.
@@ -22,6 +23,10 @@ export class EditingConfigMiddleware {
         this.config = config;
         this.handler = (_req, res) => __awaiter(this, void 0, void 0, function* () {
             const secret = _req.query[QUERY_PARAM_EDITING_SECRET];
+            if (!enforceCors(_req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             if (secret !== getJssEditingSecret()) {
                 debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, getJssEditingSecret());
                 return res.status(401).json({ message: 'Missing or invalid editing secret' });

package/dist/esm/editing/editing-data-middleware.js

@@ -9,8 +9,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 import { editingDataDiskCache } from './editing-data-cache';
 import { isEditingData } from './editing-data';
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
+import { enforceCors } from '@sitecore-jss/sitecore-jss/utils';
+import { debug } from '@sitecore-jss/sitecore-jss';
 /**
  * Middleware / handler for use in the editing data Next.js API dynamic route (e.g. '/api/editing/data/[key]')
  * which is required for Sitecore editing support.
@@ -25,6 +27,10 @@ export class EditingDataMiddleware {
             const { method, query, body } = req;
             const secret = query[QUERY_PARAM_EDITING_SECRET];
             const key = query[this.queryParamKey];
+            if (!enforceCors(req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({ message: 'Invalid origin' });
+            }
             // Validate secret
             if (secret !== getJssEditingSecret()) {
                 res.status(401).end('Missing or invalid secret');

package/dist/esm/editing/editing-render-middleware.js

@@ -12,9 +12,10 @@ import { AxiosDataFetcher, debug } from '@sitecore-jss/sitecore-jss';
 import { EDITING_COMPONENT_ID, RenderingType } from '@sitecore-jss/sitecore-jss/layout';
 import { parse } from 'node-html-parser';
 import { editingDataService } from './editing-data-service';
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
 import { RenderMiddlewareBase } from './render-middleware';
+import { enforceCors } from '@sitecore-jss/sitecore-jss/utils';
 /**
  * Middleware / handler for use in the editing render Next.js API route (e.g. '/api/editing/render')
  * which is required for Sitecore editing support.
@@ -27,7 +28,7 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
         var _a, _b, _c, _d;
         super();
         this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
-            var _e, _f;
+            var _e, _f, _g;
             const { method, query, body, headers } = req;
             const startTimestamp = Date.now();
             debug.editing('editing render middleware start: %o', {
@@ -36,6 +37,12 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
                 headers,
                 body,
             });
+            if (!enforceCors(req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res.status(401).json({
+                    html: `<html><body>Requests from origin ${(_e = req.headers) === null || _e === void 0 ? void 0 : _e.origin} not allowed</body></html>`,
+                });
+            }
             if (method !== 'POST') {
                 debug.editing('invalid method - sent %s expected POST', method);
                 res.setHeader('Allow', 'POST');
@@ -44,7 +51,7 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
                 });
             }
             // Validate secret
-            const secret = (_e = query[QUERY_PARAM_EDITING_SECRET]) !== null && _e !== void 0 ? _e : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
+            const secret = (_f = query[QUERY_PARAM_EDITING_SECRET]) !== null && _f !== void 0 ? _f : body === null || body === void 0 ? void 0 : body.jssEditingSecret;
             if (secret !== getJssEditingSecret()) {
                 debug.editing('invalid editing secret - sent "%s" expected "%s"', secret, getJssEditingSecret());
                 return res.status(401).json({
@@ -106,7 +113,7 @@ export class EditingRenderMiddleware extends RenderMiddlewareBase {
                 html = html.replace(STATIC_PROPS_ID, SERVER_PROPS_ID);
                 if (editingData.layoutData.sitecore.context.renderingType === RenderingType.Component) {
                     // Handle component rendering. Extract component markup only
-                    html = (_f = parse(html).getElementById(EDITING_COMPONENT_ID)) === null || _f === void 0 ? void 0 : _f.innerHTML;
+                    html = (_g = parse(html).getElementById(EDITING_COMPONENT_ID)) === null || _g === void 0 ? void 0 : _g.innerHTML;
                     if (!html)
                         throw new Error(`Failed to render component for ${editingData.path}`);
                 }

package/dist/esm/editing/feaas-render-middleware.js

@@ -8,9 +8,10 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
     });
 };
 import { debug } from '@sitecore-jss/sitecore-jss';
-import { QUERY_PARAM_EDITING_SECRET } from './constants';
+import { EDITING_ALLOWED_ORIGINS, QUERY_PARAM_EDITING_SECRET } from './constants';
 import { getJssEditingSecret } from '../utils/utils';
 import { RenderMiddlewareBase } from './render-middleware';
+import { enforceCors } from '@sitecore-jss/sitecore-jss/utils';
 /**
  * Middleware / handler for use in the feaas render Next.js API route (e.g. '/api/editing/feaas/render')
  * which is required for Sitecore editing support.
@@ -25,6 +26,7 @@ export class FEAASRenderMiddleware extends RenderMiddlewareBase {
         this.config = config;
         this.defaultPageUrl = '/feaas/render';
         this.handler = (req, res) => __awaiter(this, void 0, void 0, function* () {
+            var _b;
             const { method, query, headers } = req;
             const startTimestamp = Date.now();
             debug.editing('feaas render middleware start: %o', {
@@ -32,6 +34,12 @@ export class FEAASRenderMiddleware extends RenderMiddlewareBase {
                 query,
                 headers,
             });
+            if (!enforceCors(req, res, EDITING_ALLOWED_ORIGINS)) {
+                debug.editing('invalid origin host - set allowed origins in JSS_ALLOWED_ORIGINS environment variable');
+                return res
+                    .status(401)
+                    .send(`<html><body>Requests from origin ${(_b = req.headers) === null || _b === void 0 ? void 0 : _b.origin} are not allowed</body></html>`);
+            }
             if (method !== 'GET') {
                 debug.editing('invalid method - sent %s expected GET', method);
                 res.setHeader('Allow', 'GET');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sitecore-jss/sitecore-jss-nextjs",
-  "version": "22.1.0-canary.12",
+  "version": "22.1.0-canary.13",
   "main": "dist/cjs/index.js",
   "module": "dist/esm/index.js",
   "sideEffects": false,
@@ -72,9 +72,9 @@
     "react-dom": "^18.2.0"
   },
   "dependencies": {
-    "@sitecore-jss/sitecore-jss": "^22.1.0-canary.12",
-    "@sitecore-jss/sitecore-jss-dev-tools": "^22.1.0-canary.12",
-    "@sitecore-jss/sitecore-jss-react": "^22.1.0-canary.12",
+    "@sitecore-jss/sitecore-jss": "^22.1.0-canary.13",
+    "@sitecore-jss/sitecore-jss-dev-tools": "^22.1.0-canary.13",
+    "@sitecore-jss/sitecore-jss-react": "^22.1.0-canary.13",
     "@vercel/kv": "^0.2.1",
     "node-html-parser": "^6.1.4",
     "prop-types": "^15.8.1",
@@ -83,7 +83,7 @@
   },
   "description": "",
   "types": "types/index.d.ts",
-  "gitHead": "24b00de991d13bd8d10d3ff005f2315f21a4da45",
+  "gitHead": "488b31c67c7432d29b624e532a49913775b0ec3e",
   "files": [
     "dist",
     "types",

package/types/editing/constants.d.ts

@@ -1,3 +1,4 @@
 export declare const QUERY_PARAM_EDITING_SECRET = "secret";
 export declare const QUERY_PARAM_PROTECTION_BYPASS_SITECORE = "x-sitecore-protection-bypass";
 export declare const QUERY_PARAM_PROTECTION_BYPASS_VERCEL = "x-vercel-protection-bypass";
+export declare const EDITING_ALLOWED_ORIGINS: string[];