domma-cms 1.6.41 → 1.6.42

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "domma-cms",
-  "version": "1.6.41",
+  "version": "1.6.42",
   "description": "File-based CMS powered by Domma and Fastify. Run npx domma-cms my-site to create a new project.",
   "type": "module",
   "main": "server/server.js",

package/server/server.js

@@ -32,7 +32,7 @@ import * as cache from './services/cache/index.js';
 import {parseTrustProxy} from './services/network.js';
 import {requestSerializer} from './services/request-log.js';
 import {rateLimitOptions} from './services/rate-limit.js';
-import {frameSources} from './services/embedCsp.js';
+import {connectSources, frameSources} from './services/embedCsp.js';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const ROOT = path.resolve(__dirname, '..');
@@ -126,7 +126,8 @@ await app.register(helmet, {
             styleSrc: ["'self'", "'unsafe-inline'", 'https://cdn.jsdelivr.net', 'https://fonts.googleapis.com'],
             imgSrc: ["'self'", 'data:', 'blob:'],
             fontSrc: ["'self'", 'data:', 'https://fonts.gstatic.com'],
-            connectSrc: ["'self'", 'https://cdn.jsdelivr.net'],
+            // config/server.json csp.connectHosts: other sites a page may read from (services/embedCsp.js).
+            connectSrc: connectSources(serverConfig.csp?.connectHosts),
             // [embed] players and config/embeds.json hosts - without this, default-src blocked them all.
             frameSrc: frameSources((() => { try { return getConfig('embeds')?.allowedHosts; } catch { return []; } })()),
             upgradeInsecureRequests: null, // prevent browsers forcing HTTPS on HTTP deployments

package/server/services/embedCsp.js

@@ -31,3 +31,22 @@ export function frameSources(allowedHosts = []) {
         .map(h => `https://${h}`);
     return [...new Set(["'self'", ...ALWAYS_FRAMED, ...extra])];
 }
+
+/** What a page may always fetch from: the site itself and the CDN Domma's own assets come from. */
+export const ALWAYS_CONNECTED = ["'self'", 'https://cdn.jsdelivr.net'];
+
+/**
+ * The connect-src: the site, the CDN, and every host in config/server.json `csp.connectHosts` - for a page
+ * that reads another site's public API (domma-cms.com's Pricing page reads the prices dcm sells at). Bare
+ * hostnames only, served over https; anything else is dropped. Read at boot, like frame-src.
+ *
+ * @param {string[]} connectHosts - config/server.json csp.connectHosts
+ * @returns {string[]} connect-src sources
+ */
+export function connectSources(connectHosts = []) {
+    const extra = (Array.isArray(connectHosts) ? connectHosts : [])
+        .map(h => String(h).trim().toLowerCase())
+        .filter(h => HOST_RE.test(h))
+        .map(h => `https://${h}`);
+    return [...new Set([...ALWAYS_CONNECTED, ...extra])];
+}