@vendure/asset-server-plugin 3.7.3-master-202608210231 → 3.7.3-master-202608240231
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
|
@@ -48,4 +48,27 @@ export declare class AssetServer {
|
|
|
48
48
|
* Attempt to get the mime type from the file name.
|
|
49
49
|
*/
|
|
50
50
|
private getMimeType;
|
|
51
|
+
/**
|
|
52
|
+
* Sets security-related response headers on a served asset. Some permitted asset types —
|
|
53
|
+
* notably SVG, but also XML and HTML — can carry embedded scripts which execute when the
|
|
54
|
+
* asset is opened as a top-level document or embedded via `<object>`/`<iframe>`. Served
|
|
55
|
+
* inline from the Vendure origin this is a stored-XSS vector (GHSA-f4r3-h6jf-4m29).
|
|
56
|
+
*
|
|
57
|
+
* - `X-Content-Type-Options: nosniff` stops the browser from re-interpreting a response as a
|
|
58
|
+
* more dangerous type than its declared `Content-Type`.
|
|
59
|
+
* - The `Content-Security-Policy` denies scripts and subresources on every asset; for markup
|
|
60
|
+
* types it additionally sandboxes the document, so even a markup asset rendered as a
|
|
61
|
+
* top-level document cannot execute script (see `ASSET_MARKUP_CSP_HEADER` for why the
|
|
62
|
+
* `sandbox` token is markup-only).
|
|
63
|
+
* - For markup types we additionally force `Content-Disposition: attachment`, so the browser
|
|
64
|
+
* downloads rather than renders them. This does not affect `<img src>` previews (embedded
|
|
65
|
+
* images ignore the header and never execute embedded scripts); the only visible change is
|
|
66
|
+
* that opening such an asset's URL directly downloads it.
|
|
67
|
+
*/
|
|
68
|
+
private setAssetSecurityHeaders;
|
|
69
|
+
/**
|
|
70
|
+
* Whether a mime type denotes a markup document that a browser could execute script from
|
|
71
|
+
* (SVG, HTML, XHTML and generic XML). Ignores any `; charset=…` parameter.
|
|
72
|
+
*/
|
|
73
|
+
private isMarkupMimeType;
|
|
51
74
|
}
|
package/lib/src/asset-server.js
CHANGED
|
@@ -99,7 +99,7 @@ let AssetServer = class AssetServer {
|
|
|
99
99
|
mimeType = ((_a = (await getFileType(file))) === null || _a === void 0 ? void 0 : _a.mime) || 'application/octet-stream';
|
|
100
100
|
}
|
|
101
101
|
res.contentType(mimeType);
|
|
102
|
-
|
|
102
|
+
this.setAssetSecurityHeaders(res, mimeType);
|
|
103
103
|
res.setHeader('Cache-Control', this.cacheHeader);
|
|
104
104
|
res.send(file);
|
|
105
105
|
}
|
|
@@ -144,7 +144,7 @@ let AssetServer = class AssetServer {
|
|
|
144
144
|
mimeType = ((_a = (await getFileType(imageBuffer))) === null || _a === void 0 ? void 0 : _a.mime) || 'image/jpeg';
|
|
145
145
|
}
|
|
146
146
|
res.set('Content-Type', mimeType);
|
|
147
|
-
|
|
147
|
+
this.setAssetSecurityHeaders(res, mimeType);
|
|
148
148
|
res.send(imageBuffer);
|
|
149
149
|
return;
|
|
150
150
|
}
|
|
@@ -286,6 +286,41 @@ let AssetServer = class AssetServer {
|
|
|
286
286
|
getMimeType(fileName) {
|
|
287
287
|
return mime_types_1.default.lookup(fileName) || undefined;
|
|
288
288
|
}
|
|
289
|
+
/**
|
|
290
|
+
* Sets security-related response headers on a served asset. Some permitted asset types —
|
|
291
|
+
* notably SVG, but also XML and HTML — can carry embedded scripts which execute when the
|
|
292
|
+
* asset is opened as a top-level document or embedded via `<object>`/`<iframe>`. Served
|
|
293
|
+
* inline from the Vendure origin this is a stored-XSS vector (GHSA-f4r3-h6jf-4m29).
|
|
294
|
+
*
|
|
295
|
+
* - `X-Content-Type-Options: nosniff` stops the browser from re-interpreting a response as a
|
|
296
|
+
* more dangerous type than its declared `Content-Type`.
|
|
297
|
+
* - The `Content-Security-Policy` denies scripts and subresources on every asset; for markup
|
|
298
|
+
* types it additionally sandboxes the document, so even a markup asset rendered as a
|
|
299
|
+
* top-level document cannot execute script (see `ASSET_MARKUP_CSP_HEADER` for why the
|
|
300
|
+
* `sandbox` token is markup-only).
|
|
301
|
+
* - For markup types we additionally force `Content-Disposition: attachment`, so the browser
|
|
302
|
+
* downloads rather than renders them. This does not affect `<img src>` previews (embedded
|
|
303
|
+
* images ignore the header and never execute embedded scripts); the only visible change is
|
|
304
|
+
* that opening such an asset's URL directly downloads it.
|
|
305
|
+
*/
|
|
306
|
+
setAssetSecurityHeaders(res, mimeType) {
|
|
307
|
+
res.setHeader('X-Content-Type-Options', 'nosniff');
|
|
308
|
+
if (this.isMarkupMimeType(mimeType)) {
|
|
309
|
+
res.setHeader('Content-Security-Policy', constants_1.ASSET_MARKUP_CSP_HEADER);
|
|
310
|
+
res.setHeader('Content-Disposition', 'attachment');
|
|
311
|
+
}
|
|
312
|
+
else {
|
|
313
|
+
res.setHeader('Content-Security-Policy', constants_1.ASSET_CSP_HEADER);
|
|
314
|
+
}
|
|
315
|
+
}
|
|
316
|
+
/**
|
|
317
|
+
* Whether a mime type denotes a markup document that a browser could execute script from
|
|
318
|
+
* (SVG, HTML, XHTML and generic XML). Ignores any `; charset=…` parameter.
|
|
319
|
+
*/
|
|
320
|
+
isMarkupMimeType(mimeType) {
|
|
321
|
+
const normalized = mimeType.split(';')[0].trim().toLowerCase();
|
|
322
|
+
return constants_1.MARKUP_MIME_TYPES.includes(normalized) || normalized.endsWith('+xml');
|
|
323
|
+
}
|
|
289
324
|
};
|
|
290
325
|
exports.AssetServer = AssetServer;
|
|
291
326
|
exports.AssetServer = AssetServer = __decorate([
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"asset-server.js","sourceRoot":"","sources":["../../src/asset-server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,wCAA4F;AAC5F,mCAAoC;AACpC,sDAAmE;AACnE,wDAA0B;AAC1B,4DAA8B;AAC9B,gDAAwB;AAExB,qCAA0C;AAE1C,kFAA4E;AAC5E,
|
|
1
|
+
{"version":3,"file":"asset-server.js","sourceRoot":"","sources":["../../src/asset-server.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;AAAA,2CAAoD;AACpD,wCAA4F;AAC5F,mCAAoC;AACpC,sDAAmE;AACnE,wDAA0B;AAC1B,4DAA8B;AAC9B,gDAAwB;AAExB,qCAA0C;AAE1C,kFAA4E;AAC5E,2CAOqB;AACrB,uDAAmD;AAGnD,KAAK,UAAU,WAAW,CAAC,MAAc;IACrC,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACzD,OAAO,kBAAkB,CAAC,MAAM,CAAC,CAAC;AACtC,CAAC;AAED;;;GAGG;AAEI,IAAM,WAAW,GAAjB,MAAM,WAAW;IAOpB,YAC8C,OAAmC,EACrE,aAA4B,EAC5B,cAA8B;QAFY,YAAO,GAAP,OAAO,CAAoB;QACrE,kBAAa,GAAb,aAAa,CAAe;QAC5B,mBAAc,GAAd,cAAc,CAAgB;QARzB,aAAQ,GAAG,OAAO,CAAC;QAUhC,IAAI,CAAC,oBAAoB,GAAG,IAAI,CAAC,aAAa,CAAC,YAAY,CAAC,oBAAoB,CAAC;IACrF,CAAC;IAED,gBAAgB;IAChB,sBAAsB;QAClB,IAAI,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,CAAC;YAC/B,OAAO;QACX,CAAC;QACD,iCAAiC;QACjC,MAAM,EAAE,WAAW,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC;QACrC,IAAI,CAAC,WAAW,EAAE,CAAC;YACf,IAAI,CAAC,WAAW,GAAG,gCAAoB,CAAC;QAC5C,CAAC;aAAM,CAAC;YACJ,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;gBAClC,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;YACnC,CAAC;iBAAM,CAAC;gBACJ,IAAI,CAAC,WAAW,GAAG,CAAC,WAAW,CAAC,WAAW,EAAE,YAAY,WAAW,CAAC,MAAM,EAAE,CAAC;qBACzE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;qBACxB,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,CAAC;QACL,CAAC;QAED,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxE,kBAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,YAGjB;QACG,IAAI,CAAC,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC;QACpC,IAAI,CAAC,wBAAwB,GAAG,YAAY,CAAC,wBAAwB,CAAC;QACtE,MAAM,WAAW,GAAG,iBAAO,CAAC,MAAM,EAAE,CAAC;QACrC,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,IAAI,CAAC,wBAAwB,EAAE,CAAC,CAAC;QACnE,OAAO,WAAW,CAAC;IACvB,CAAC;IAED;;OAEG;IACK,SAAS;QACb,OAAO,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;;YAC7D,IAAI,MAAgC,CAAC;YACrC,IAAI,CAAC;gBACD,MAAM,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,aAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,qBAAS,CAAC,CAAC;gBACnC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;gBAC3C,OAAO;YACX,CAAC;YACD,MAAM,GAAG,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7D,IAAI,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC;gBACnE,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;gBACrC,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACZ,QAAQ,GAAG,CAAA,MAAA,CAAC,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC,0CAAE,IAAI,KAAI,0BAA0B,CAAC;gBAC7E,CAAC;gBACD,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;gBAC1B,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC5C,GAAG,CAAC,SAAS,CAAC,eAAe,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;gBACjD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC;gBACvC,GAAW,CAAC,MAAM,GAAG,GAAG,CAAC;gBAC1B,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;YACrB,CAAC;QACL,CAAC,CAAC;IACN,CAAC;IAED;;;;OAIG;IACK,wBAAwB;QAC5B,OAAO,KAAK,EAAE,GAAQ,EAAE,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;;YACvE,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,EAAE,CAAC;gBACxD,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;oBACZ,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACvD,aAAM,CAAC,KAAK,CAAC,+BAA+B,cAAc,EAAE,EAAE,qBAAS,CAAC,CAAC;oBACzE,IAAI,IAAY,CAAC;oBACjB,IAAI,CAAC;wBACD,IAAI,GAAG,MAAM,IAAI,CAAC,oBAAoB,CAAC,gBAAgB,CAAC,cAAc,CAAC,CAAC;oBAC5E,CAAC;oBAAC,OAAO,IAAS,EAAE,CAAC;wBACjB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;wBAC3C,OAAO;oBACX,CAAC;oBACD,IAAI,CAAC;wBACD,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,CAAC;wBAC/D,MAAM,KAAK,GAAG,MAAM,IAAA,gCAAc,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC;wBACrD,MAAM,WAAW,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE,CAAC;wBAC3C,MAAM,cAAc,GAAG,IAAI,CAAC,yBAAyB,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;wBAC5E,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;4BACjD,MAAM,IAAI,CAAC,oBAAoB,CAAC,mBAAmB,CAAC,cAAc,EAAE,WAAW,CAAC,CAAC;4BACjF,aAAM,CAAC,KAAK,CAAC,uBAAuB,cAAc,EAAE,EAAE,qBAAS,CAAC,CAAC;wBACrE,CAAC;wBACD,IAAI,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;wBAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;4BACZ,QAAQ,GAAG,CAAA,MAAA,CAAC,MAAM,WAAW,CAAC,WAAW,CAAC,CAAC,0CAAE,IAAI,KAAI,YAAY,CAAC;wBACtE,CAAC;wBACD,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;wBAClC,IAAI,CAAC,uBAAuB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;wBAC5C,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;wBACtB,OAAO;oBACX,CAAC;oBAAC,OAAO,CAAM,EAAE,CAAC;wBACd,aAAM,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,EAAE,qBAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;wBAC5C,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;wBACpE,OAAO;oBACX,CAAC;gBACL,CAAC;YACL,CAAC;YACD,IAAI,EAAE,CAAC;QACX,CAAC,CAAC;IACN,CAAC;IAEO,KAAK,CAAC,2BAA2B,CAAC,GAAY;QAClD,IAAI,UAAU,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,KAAY,CAAC,CAAC;QAC3E,KAAK,MAAM,QAAQ,IAAI,IAAI,CAAC,wBAAwB,EAAE,CAAC;YACnD,IAAI,CAAC;gBACD,UAAU,GAAG,MAAM,QAAQ,CAAC,2BAA2B,CAAC;oBACpD,GAAG;oBACH,KAAK,oBAAO,UAAU,CAAE;oBACxB,gBAAgB,EAAE,IAAI,CAAC,OAAO;iBACjC,CAAC,CAAC;YACP,CAAC;YAAC,OAAO,CAAM,EAAE,CAAC;gBACd,aAAM,CAAC,KAAK,CAAC,yCAAyC,GAAI,CAAC,CAAC,OAAkB,EAAE,qBAAS,CAAC,CAAC;gBAC3F,MAAM,CAAC,CAAC;YACZ,CAAC;QACL,CAAC;QAED,IAAI,WAAW,GAAuB,UAAU,CAAC,KAAK,CAAC;QACvD,IAAI,YAAY,GAAuB,UAAU,CAAC,MAAM,CAAC;QACzD,IAAI,UAAU,GAAmC,UAAU,CAAC,IAAI,CAAC;QAEjE,IAAI,UAAU,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,MAAM,CAAC,CAAC;YAC5E,IAAI,cAAc,EAAE,CAAC;gBACjB,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC;gBACnC,YAAY,GAAG,cAAc,CAAC,MAAM,CAAC;gBACrC,UAAU,GAAG,cAAc,CAAC,IAAI,CAAC;YACrC,CAAC;QACL,CAAC;QACD,uCACO,UAAU,KACb,KAAK,EAAE,WAAW,EAClB,MAAM,EAAE,YAAY,EACpB,IAAI,EAAE,UAAU,IAClB;IACN,CAAC;IAEO,kCAAkC,CACtC,WAAmC;QAEnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACtD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC;QACvD,MAAM,OAAO,GACT,WAAW,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,MAAM,IAAI,GAAuB,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC;QACnF,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,SAAS,CAAC;QAC1C,MAAM,GAAG,GAAG,CAAC,WAAW,CAAC,GAAG,IAAI,SAAS,CAAC;QAC1C,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAElD,OAAO;YACH,KAAK;YACL,MAAM;YACN,OAAO;YACP,MAAM;YACN,IAAI;YACJ,GAAG;YACH,GAAG;YACH,MAAM,EAAE,WAAW,CAAC,MAAM;SAC7B,CAAC;IACN,CAAC;IAEO,yBAAyB,CAAC,QAAgB,EAAE,MAAgC;QAChF,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,MAAM,CAAC;QACnF,qEAAqE;QACrE,MAAM,UAAU,GAAG,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5D,MAAM,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,WAAW,GAAG,IAAA,uBAAc,EAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,iBAAiB,GAAG,EAAE,CAAC;QAC3B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACT,MAAM,KAAK,GAAG,CAAC,IAAI,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;YACvB,iBAAiB,GAAG,eAAe,KAAK,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC;QACnE,CAAC;aAAM,IAAI,MAAM,EAAE,CAAC;YAChB,IAAI,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,EAAE,CAAC;gBAC9D,iBAAiB,GAAG,kBAAkB,MAAM,EAAE,CAAC;YACnD,CAAC;QACL,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACb,iBAAiB,IAAI,UAAU,CAAC;QACpC,CAAC;QACD,IAAI,WAAW,EAAE,CAAC;YACd,iBAAiB,IAAI,WAAW,CAAC;QACrC,CAAC;QACD,IAAI,OAAO,EAAE,CAAC;YACV,iBAAiB,IAAI,OAAO,CAAC;QACjC,CAAC;QAED,MAAM,cAAc,GAAG,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QACvD,IAAI,iBAAiB,KAAK,EAAE,EAAE,CAAC;YAC3B,MAAM,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACnD,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,cAAc,EAAE,cAAc,EAAE,WAAW,CAAC,CAAC,CAAC;QACjG,CAAC;aAAM,CAAC;YACJ,OAAO,cAAc,CAAC;QAC1B,CAAC;IACL,CAAC;IAED;;OAEG;IACK,gBAAgB,CAAC,QAAgB;QACrC,IAAI,WAAmB,CAAC;QACxB,IAAI,CAAC;YACD,WAAW,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,CAAM,EAAE,CAAC;YACd,aAAM,CAAC,KAAK,CAAE,CAAC,CAAC,OAAkB,GAAG,IAAI,GAAG,QAAQ,EAAE,qBAAS,CAAC,CAAC;YACjE,OAAO,EAAE,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,oBAAoB,YAAY,kDAAsB,EAAE,CAAC;YAC9D,6DAA6D;YAC7D,kEAAkE;YAClE,uDAAuD;YACvD,OAAO,WAAW,CAAC;QACvB,CAAC;aAAM,CAAC;YACJ,+FAA+F;YAC/F,MAAM,cAAc,GAAG,cAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;YACnD,IAAI,aAAa,GAAG,cAAc,CAAC;YACnC,IAAI,YAAY,CAAC;YACjB,GAAG,CAAC;gBACA,YAAY,GAAG,aAAa,CAAC;gBAC7B,aAAa,GAAG,YAAY,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;YAC9D,CAAC,QAAQ,aAAa,KAAK,YAAY,EAAE;YACzC,OAAO,aAAa,CAAC;QACzB,CAAC;IACL,CAAC;IAEO,GAAG,CAAC,KAAa;QACrB,OAAO,IAAA,mBAAU,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACzD,CAAC;IAEO,SAAS,CAAC,QAAgB,EAAE,MAAc,EAAE,GAAY;QAC5D,MAAM,WAAW,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;QACnD,MAAM,QAAQ,GAAG,cAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,OAAO,GAAG,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QACvC,OAAO,cAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,QAAQ,GAAG,MAAM,GAAG,YAAY,EAAE,CAAC,CAAC;IACrE,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,QAAgB;QAChC,OAAO,oBAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC;IAC9C,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACK,uBAAuB,CAAC,GAAa,EAAE,QAAgB;QAC3D,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,mCAAuB,CAAC,CAAC;YAClE,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,YAAY,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACJ,GAAG,CAAC,SAAS,CAAC,yBAAyB,EAAE,4BAAgB,CAAC,CAAC;QAC/D,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,gBAAgB,CAAC,QAAgB;QACrC,MAAM,UAAU,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC/D,OAAO,6BAAiB,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;CACJ,CAAA;AApTY,kCAAW;sBAAX,WAAW;IADvB,IAAA,mBAAU,GAAE;IASJ,WAAA,IAAA,eAAM,EAAC,4CAAgC,CAAC,CAAA;6CAClB,oBAAa;QACZ,qBAAc;GAVjC,WAAW,CAoTvB"}
|
package/lib/src/constants.d.ts
CHANGED
|
@@ -1,3 +1,19 @@
|
|
|
1
1
|
export declare const loggerCtx = "AssetServerPlugin";
|
|
2
2
|
export declare const DEFAULT_CACHE_HEADER = "public, max-age=15552000";
|
|
3
3
|
export declare const ASSET_SERVER_PLUGIN_INIT_OPTIONS: unique symbol;
|
|
4
|
+
/**
|
|
5
|
+
* CSP applied to every served asset: denies scripts and subresources, so a scriptable asset
|
|
6
|
+
* whose mime type we misidentified still cannot execute script.
|
|
7
|
+
*/
|
|
8
|
+
export declare const ASSET_CSP_HEADER = "default-src 'none'; script-src 'none'";
|
|
9
|
+
/**
|
|
10
|
+
* CSP applied to markup assets (SVG/HTML/XML) on top of a forced download: the extra `sandbox`
|
|
11
|
+
* token sandboxes the document as defence in depth. Kept off non-markup assets so that e.g. PDFs
|
|
12
|
+
* still render inline in the browser's built-in viewer.
|
|
13
|
+
*/
|
|
14
|
+
export declare const ASSET_MARKUP_CSP_HEADER = "default-src 'none'; script-src 'none'; sandbox";
|
|
15
|
+
/**
|
|
16
|
+
* Mime types (ignoring any `; charset=…`) denoting a markup document a browser could execute
|
|
17
|
+
* script from. `*+xml` (e.g. `image/svg+xml`) is matched separately by suffix.
|
|
18
|
+
*/
|
|
19
|
+
export declare const MARKUP_MIME_TYPES: string[];
|
package/lib/src/constants.js
CHANGED
|
@@ -1,7 +1,23 @@
|
|
|
1
1
|
"use strict";
|
|
2
2
|
Object.defineProperty(exports, "__esModule", { value: true });
|
|
3
|
-
exports.ASSET_SERVER_PLUGIN_INIT_OPTIONS = exports.DEFAULT_CACHE_HEADER = exports.loggerCtx = void 0;
|
|
3
|
+
exports.MARKUP_MIME_TYPES = exports.ASSET_MARKUP_CSP_HEADER = exports.ASSET_CSP_HEADER = exports.ASSET_SERVER_PLUGIN_INIT_OPTIONS = exports.DEFAULT_CACHE_HEADER = exports.loggerCtx = void 0;
|
|
4
4
|
exports.loggerCtx = 'AssetServerPlugin';
|
|
5
5
|
exports.DEFAULT_CACHE_HEADER = 'public, max-age=15552000';
|
|
6
6
|
exports.ASSET_SERVER_PLUGIN_INIT_OPTIONS = Symbol('ASSET_SERVER_PLUGIN_INIT_OPTIONS');
|
|
7
|
+
/**
|
|
8
|
+
* CSP applied to every served asset: denies scripts and subresources, so a scriptable asset
|
|
9
|
+
* whose mime type we misidentified still cannot execute script.
|
|
10
|
+
*/
|
|
11
|
+
exports.ASSET_CSP_HEADER = "default-src 'none'; script-src 'none'";
|
|
12
|
+
/**
|
|
13
|
+
* CSP applied to markup assets (SVG/HTML/XML) on top of a forced download: the extra `sandbox`
|
|
14
|
+
* token sandboxes the document as defence in depth. Kept off non-markup assets so that e.g. PDFs
|
|
15
|
+
* still render inline in the browser's built-in viewer.
|
|
16
|
+
*/
|
|
17
|
+
exports.ASSET_MARKUP_CSP_HEADER = `${exports.ASSET_CSP_HEADER}; sandbox`;
|
|
18
|
+
/**
|
|
19
|
+
* Mime types (ignoring any `; charset=…`) denoting a markup document a browser could execute
|
|
20
|
+
* script from. `*+xml` (e.g. `image/svg+xml`) is matched separately by suffix.
|
|
21
|
+
*/
|
|
22
|
+
exports.MARKUP_MIME_TYPES = ['text/html', 'text/xml', 'application/xml'];
|
|
7
23
|
//# sourceMappingURL=constants.js.map
|
package/lib/src/constants.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,SAAS,GAAG,mBAAmB,CAAC;AAChC,QAAA,oBAAoB,GAAG,0BAA0B,CAAC;AAClD,QAAA,gCAAgC,GAAG,MAAM,CAAC,kCAAkC,CAAC,CAAC"}
|
|
1
|
+
{"version":3,"file":"constants.js","sourceRoot":"","sources":["../../src/constants.ts"],"names":[],"mappings":";;;AAAa,QAAA,SAAS,GAAG,mBAAmB,CAAC;AAChC,QAAA,oBAAoB,GAAG,0BAA0B,CAAC;AAClD,QAAA,gCAAgC,GAAG,MAAM,CAAC,kCAAkC,CAAC,CAAC;AAE3F;;;GAGG;AACU,QAAA,gBAAgB,GAAG,uCAAuC,CAAC;AACxE;;;;GAIG;AACU,QAAA,uBAAuB,GAAG,GAAG,wBAAgB,WAAW,CAAC;AACtE;;;GAGG;AACU,QAAA,iBAAiB,GAAG,CAAC,WAAW,EAAE,UAAU,EAAE,iBAAiB,CAAC,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vendure/asset-server-plugin",
|
|
3
|
-
"version": "3.7.3-master-
|
|
3
|
+
"version": "3.7.3-master-202608240231",
|
|
4
4
|
"main": "lib/index.js",
|
|
5
5
|
"types": "lib/index.d.ts",
|
|
6
6
|
"files": [
|
|
@@ -29,8 +29,8 @@
|
|
|
29
29
|
"@aws-sdk/lib-storage": "^3.529.1",
|
|
30
30
|
"@types/fs-extra": "^11.0.4",
|
|
31
31
|
"@types/mime-types": "^3.0.1",
|
|
32
|
-
"@vendure/common": "^3.7.3-master-
|
|
33
|
-
"@vendure/core": "^3.7.3-master-
|
|
32
|
+
"@vendure/common": "^3.7.3-master-202608240231",
|
|
33
|
+
"@vendure/core": "^3.7.3-master-202608240231",
|
|
34
34
|
"rimraf": "^5.0.5",
|
|
35
35
|
"typescript": "5.8.2"
|
|
36
36
|
},
|