@zappie/check 0.2.1 → 0.2.3

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # @zappie/check
 
+## 0.2.3
+
+### Patch Changes
+
+- 9b25eb7: The packages now live in zappie/storefront-packages, and each package's repository, homepage and issues links point there. This release is the first one published from that repository.
+- Updated dependencies [9b25eb7]
+  - @zappie/sdk@0.1.13
+  - @zappie/tokens@0.1.2
+  - eslint-plugin-zappie@0.3.1
+
+## 0.2.2
+
+### Patch Changes
+
+- afb46d4: Add storefront security lint rules, pass outbound hosts from `zappie.config.ts` to ESLint, and provide `safeRedirect` from `@zappie/sdk/redirect` for untrusted navigation targets.
+- Updated dependencies [2b672c9]
+- Updated dependencies [9b5b412]
+- Updated dependencies [32ecccf]
+- Updated dependencies [afb46d4]
+- Updated dependencies [6a8e227]
+- Updated dependencies [c0171ae]
+- Updated dependencies [0cbc4da]
+  - @zappie/sdk@0.1.12
+  - eslint-plugin-zappie@0.3.0
+
 ## 0.2.1
 
 ### Patch Changes

package/dist/index.js

@@ -67,7 +67,7 @@ var globallyAllowed = (value) => GLOBAL_PACKAGE_ALLOWLIST.some(
 function hostname(value) {
   const wildcard = value.startsWith("*.");
   const host = wildcard ? value.slice(2) : value;
-  if (!host.includes(".") || /^\d+(?:\.\d+){3}$/.test(host) || host.length > 253 || host.includes("..")) {
+  if (!host.includes(".") || /^\d+(?:\.\d+){3}$/.test(host) || host.length > 253 || host.includes("..") || wildcard && /^(?:ac|co|com|edu|gov|net|org)\.[^.]+$/i.test(host)) {
     return false;
   }
   return host.split(".").every(
@@ -183,6 +183,7 @@ var rootKeys = [
   "packages",
   "audit",
   "outbound",
+  "security",
   "budgets",
   "readiness",
   "analytics"
@@ -236,16 +237,20 @@ function validateConfig(input) {
     });
   });
   nested(input.outbound, "outbound", ["allow"], issue, (value) => {
-    const allow = stringList(value.allow, "outbound.allow", error);
-    allow?.forEach((host, index) => {
-      if (!hostname(host)) {
-        error(
-          `outbound.allow[${index}]`,
-          "invalid_format",
-          "Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com."
-        );
+    hostList(value.allow, "outbound.allow", error);
+  });
+  nested(input.security, "security", ["csp"], issue, (security) => {
+    nested(
+      security.csp,
+      "security.csp",
+      ["imgSrc", "connectSrc", "fontSrc", "styleSrc", "frameSrc"],
+      issue,
+      (csp) => {
+        for (const [name, value] of Object.entries(csp)) {
+          hostList(value, `security.csp.${name}`, error);
+        }
       }
-    });
+    );
   });
   budgets(input.budgets, issue, error);
   nested(
@@ -346,6 +351,17 @@ function stringList(value, path15, error, options = {}) {
   }
   return value;
 }
+function hostList(value, path15, error) {
+  stringList(value, path15, error)?.forEach((host, index) => {
+    if (!hostname(host)) {
+      error(
+        `${path15}[${index}]`,
+        "invalid_format",
+        "Expected a hostname or leading *. subdomain pattern without a scheme, path, port or IP. Use a value such as api.example.com."
+      );
+    }
+  });
+}
 function paths(value, error) {
   const values = stringList(value, "prerender", error, { unique: true });
   values?.forEach((path15, index) => {
@@ -2784,7 +2800,12 @@ async function checkLint({
     ]);
   }
   try {
-    const eslint = new ESLint({ cwd });
+    const eslint = new ESLint({
+      cwd,
+      overrideConfig: {
+        settings: { zappie: { outboundAllow: await outboundAllow(cwd) } }
+      }
+    });
     const source = await sourceFile(cwd);
     const config = await eslint.calculateConfigForFile(source);
     const problems = recommendedProblems(config?.rules ?? {});
@@ -2818,6 +2839,23 @@ async function checkLint({
     ]);
   }
 }
+async function outboundAllow(cwd) {
+  try {
+    const value = (await loadConfig(cwd)).value;
+    if (!value || typeof value !== "object" || !("outbound" in value)) {
+      return [];
+    }
+    const outbound = value.outbound;
+    if (!outbound || typeof outbound !== "object" || !("allow" in outbound)) {
+      return [];
+    }
+    return Array.isArray(outbound.allow) ? outbound.allow.filter(
+      (entry) => typeof entry === "string"
+    ) : [];
+  } catch {
+    return [];
+  }
+}
 function recommendedProblems(applied) {
   const expected = recommendedRules();
   return Object.entries(expected).flatMap(([rule, severity]) => {