@sticklightapp/tanstack-vite-config 0.0.7 → 0.0.9

package/define-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"define-config.d.ts","sourceRoot":"","sources":["../src/define-config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,SAAS,MAAM,sBAAsB,CAAC;AAG7C,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACxF,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAGtE,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG5G,KAAK,oBAAoB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,KAAK,YAAY,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,WAAW,yBAAyB;IACzC,+GAA+G;IAC/G,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,kCAAkC;IAClC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,yBAA8B,IACrD,KAAK,SAAS,KAAG,OAAO,CAAC,UAAU,CAAC,CAmBlD"}
+{"version":3,"file":"define-config.d.ts","sourceRoot":"","sources":["../src/define-config.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,MAAM,mCAAmC,CAAC;AAClE,OAAO,SAAS,MAAM,sBAAsB,CAAC;AAG7C,OAAO,EAAgB,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,MAAM,CAAC;AACxF,OAAO,EAAyB,KAAK,YAAY,EAAE,MAAM,YAAY,CAAC;AAItE,OAAO,EAAqB,KAAK,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AACvF,OAAO,EAA4C,KAAK,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAG5G,KAAK,oBAAoB,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC7E,KAAK,YAAY,GAAG,WAAW,CAAC,UAAU,CAAC,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAEjE,MAAM,WAAW,yBAAyB;IACzC,+GAA+G;IAC/G,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,2CAA2C;IAC3C,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC;IACzB,8EAA8E;IAC9E,aAAa,CAAC,EAAE,oBAAoB,CAAC;IACrC,kCAAkC;IAClC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,2GAA2G;IAC3G,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,sDAAsD;IACtD,WAAW,CAAC,EAAE,kBAAkB,CAAC;CACjC;AAED,wBAAgB,YAAY,CAAC,OAAO,GAAE,yBAA8B,IACrD,KAAK,SAAS,KAAG,OAAO,CAAC,UAAU,CAAC,CAmBlD"}

package/define-config.js

@@ -8,6 +8,7 @@ import { createLogger } from 'vite';
 import { buildOnlyNitroPlugins } from './nitro.js';
 import { DEV_SCRIPTS_INJECTOR, injectDevToolsPlugin } from './plugins/dev-tools.js';
 import { structuredLoggerPlugin } from './plugins/structured-logger.js';
+import { svgSecurityHeadersPlugin } from './plugins/svg-security-headers.js';
 import { tailwindCdnPlugin } from './plugins/tailwind-cdn.js';
 import { resolveViteConfig, SANDBOX_WATCH_IGNORES } from './resolve-vite-config.js';
 import { captureConsoleErrors, emit } from './sandbox-log.js';
@@ -71,6 +72,7 @@ async function createPlugins(env, options) {
         viteReact(options.react),
         injectDevToolsPlugin(),
         structuredLoggerPlugin(),
+        svgSecurityHeadersPlugin(),
         ...(options.plugins ?? []),
     ];
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sticklightapp/tanstack-vite-config",
-  "version": "0.0.7",
+  "version": "0.0.9",
   "description": "Vite configuration for Sticklight TanStack Start apps",
   "keywords": [
     "vite",

package/plugins/svg-security-headers.d.ts

@@ -0,0 +1,11 @@
+import type { Plugin } from 'vite';
+/**
+ * Adds SVG security headers to all SVG responses.
+ *
+ * SVGs can contain scripts that execute when embedded via object/embed/iframe.
+ * These headers provide defense-in-depth:
+ * - Content-Security-Policy: sandbox prevents script execution
+ * - X-Content-Type-Options: nosniff prevents MIME-sniffing attacks
+ */
+export declare function svgSecurityHeadersPlugin(): Plugin;
+//# sourceMappingURL=svg-security-headers.d.ts.map

package/plugins/svg-security-headers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"svg-security-headers.d.ts","sourceRoot":"","sources":["../../src/plugins/svg-security-headers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAInC;;;;;;;GAOG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAUjD"}

package/plugins/svg-security-headers.js

@@ -0,0 +1,146 @@
+/**
+ * Adds SVG security headers to all SVG responses.
+ *
+ * SVGs can contain scripts that execute when embedded via object/embed/iframe.
+ * These headers provide defense-in-depth:
+ * - Content-Security-Policy: sandbox prevents script execution
+ * - X-Content-Type-Options: nosniff prevents MIME-sniffing attacks
+ */
+export function svgSecurityHeadersPlugin() {
+    return {
+        name: 'svg-security-headers',
+        configureServer(server) {
+            applySvgSecurityMiddleware(server.middlewares);
+        },
+        configurePreviewServer(server) {
+            applySvgSecurityMiddleware(server.middlewares);
+        },
+    };
+}
+function applySvgSecurityMiddleware(middlewares) {
+    middlewares.use((req, res, next) => {
+        const originalWriteHead = res.writeHead.bind(res);
+        // Override writeHead to intercept and modify headers for SVG responses
+        res.writeHead = function (statusCode, ...args) {
+            // Parse arguments: (statusCode), (statusCode, headers), or (statusCode, statusMessage, headers)
+            let statusMessage;
+            let headers;
+            if (typeof args[0] === 'string') {
+                // (statusCode, statusMessage, headers)
+                statusMessage = args[0];
+                headers = args[1];
+            }
+            else if (typeof args[0] === 'object') {
+                // (statusCode, headers)
+                headers = args[0];
+            }
+            // Detect if this is an SVG response
+            const isSvg = isSvgResponse(req, res, headers);
+            if (isSvg) {
+                // Clone headers or create new object to avoid mutating caller's object
+                const modifiedHeaders = headers ? { ...headers } : {};
+                // Remove any existing CSP or X-Content-Type-Options headers (case-insensitive)
+                for (const key of Object.keys(modifiedHeaders)) {
+                    const lowerKey = key.toLowerCase();
+                    if (lowerKey === 'content-security-policy' || lowerKey === 'x-content-type-options') {
+                        delete modifiedHeaders[key];
+                    }
+                }
+                // Apply SVG security headers
+                modifiedHeaders['Content-Security-Policy'] = "sandbox; script-src 'none'";
+                modifiedHeaders['X-Content-Type-Options'] = 'nosniff';
+                // Call original with modified headers
+                if (statusMessage) {
+                    return originalWriteHead(statusCode, statusMessage, modifiedHeaders);
+                }
+                else {
+                    return originalWriteHead(statusCode, modifiedHeaders);
+                }
+            }
+            // Not an SVG, pass through unchanged
+            if (statusMessage) {
+                return originalWriteHead(statusCode, statusMessage, headers);
+            }
+            else if (headers) {
+                return originalWriteHead(statusCode, headers);
+            }
+            else {
+                return originalWriteHead(statusCode);
+            }
+        };
+        next();
+    });
+}
+/**
+ * Check if the request/response is for an SVG file.
+ * Checks both content-type header and URL path extension.
+ */
+function isSvgResponse(req, res, headersArg) {
+    // Check content-type from multiple sources (case-insensitive)
+    const contentType = getContentType(res, headersArg);
+    if (contentType) {
+        const mimeType = contentType.split(';')[0]?.trim().toLowerCase();
+        if (mimeType === 'image/svg+xml') {
+            return true;
+        }
+    }
+    // Check URL path extension
+    if (req.url) {
+        return isSvgPath(req.url);
+    }
+    return false;
+}
+/**
+ * Extract content-type header case-insensitively from headers argument or res.getHeader.
+ */
+function getContentType(res, headersArg) {
+    // Check headers argument (object or array format)
+    if (headersArg) {
+        if (Array.isArray(headersArg)) {
+            // Array of [name, value] pairs
+            for (const [name, value] of headersArg) {
+                if (name.toLowerCase() === 'content-type') {
+                    return Array.isArray(value) ? value[0] : value;
+                }
+            }
+        }
+        else {
+            // Object format
+            for (const key of Object.keys(headersArg)) {
+                if (key.toLowerCase() === 'content-type') {
+                    const value = headersArg[key];
+                    return Array.isArray(value) ? value[0] : value;
+                }
+            }
+        }
+    }
+    // Fallback to res.getHeader
+    const header = res.getHeader('content-type');
+    if (header) {
+        return Array.isArray(header) ? header[0] : String(header);
+    }
+    return undefined;
+}
+/**
+ * Check if a URL path ends with .svg extension.
+ * Handles query strings, fragments, percent-encoding, and case-insensitivity.
+ */
+function isSvgPath(url) {
+    try {
+        // Parse URL to extract pathname, stripping query and hash
+        // Using URL constructor with a dummy base for relative URLs
+        const parsed = new URL(url, 'http://localhost');
+        const pathname = parsed.pathname;
+        // Decode percent-encoding (e.g., %2Esvg -> .svg)
+        // decodeURIComponent can throw on invalid encoding
+        const decoded = decodeURIComponent(pathname);
+        // Check if pathname ends with .svg (case-insensitive)
+        return decoded.toLowerCase().endsWith('.svg');
+    }
+    catch {
+        // If URL parsing or decoding fails, fall back to simple check
+        // Strip query and hash manually
+        const pathOnly = url.split('?')[0]?.split('#')[0] ?? '';
+        return pathOnly.toLowerCase().endsWith('.svg');
+    }
+}