ep_helmet 11.0.16 → 11.0.17

package/expressConfigure.js

@@ -5,7 +5,13 @@ const crypto = require('crypto');
 const settings = require('ep_etherpad-lite/node/utils/Settings');
 
 exports.expressConfigure = (hookName, app, cb) => {
-  app.app.use(helmet());
+  // Disable helmet's default Content-Security-Policy so the plugin
+  // doesn't accidentally lock down a working Etherpad install. The
+  // optional settings.ep_helmet.csp block below is the documented way
+  // for operators to opt in. With the default in place, strict
+  // 'script-src self' broke every page that relied on inline scripts
+  // or runtime eval (notably Playwright's waitForFunction in tests).
+  app.app.use(helmet({contentSecurityPolicy: false}));
 
   if (settings.ep_helmet) {
     console.debug('Using config from Helmet. ', settings.ep_helmet);

package/package.json

@@ -1,7 +1,7 @@
 {
   "description": "Adds Security headers to Etherpad Express responses, including CSP(content security policy), and x-frame-origin, useful for if you embed Etherpad in an iFrame",
   "name": "ep_helmet",
-  "version": "11.0.16",
+  "version": "11.0.17",
   "author": {
     "name": "John McLear",
     "email": "john@mclear.co.uk"

package/static/tests/frontend-new/specs/smoke.spec.ts

@@ -0,0 +1,13 @@
+import {expect, test} from '@playwright/test';
+import {getPadBody, goToNewPad} from 'ep_etherpad-lite/tests/frontend-new/helper/padHelper';
+
+test.beforeEach(async ({page}) => {
+  await goToNewPad(page);
+});
+
+test.describe('ep_helmet', () => {
+  test('pad loads with plugin installed', async ({page}) => {
+    const padBody = await getPadBody(page);
+    await expect(padBody).toBeVisible();
+  });
+});