nuxt-security-module 4.3.1 → 4.3.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.d.ts +0 -2
- package/dist/index.js +1 -2
- package/dist/models/AllowedMethodsRestricterOptions.d.ts +1 -3
- package/dist/models/BasicAuthOptions.d.ts +1 -3
- package/dist/models/ContentSecurityPolicy.d.ts +1 -3
- package/dist/models/CorsHandlerOptions.d.ts +1 -3
- package/dist/models/CrossOriginEmbedderPolicy.d.ts +1 -3
- package/dist/models/CrossOriginEmbedderPolicy.js +1 -2
- package/dist/models/CsrfOptions.d.ts +1 -3
- package/dist/models/ModuleOptions.d.ts +1 -3
- package/dist/models/PermissionsPolicy.d.ts +1 -3
- package/dist/models/RateLimitWindow.d.ts +1 -3
- package/dist/models/RateLimiterOptions.d.ts +1 -3
- package/dist/models/RateLimiterStore.d.ts +1 -3
- package/dist/models/RequestSizeLimiterOptions.d.ts +1 -3
- package/dist/models/SecurityHeaders.d.ts +1 -3
- package/dist/models/SecurityRouteRules.d.ts +1 -3
- package/dist/models/SecurityRules.d.ts +1 -3
- package/dist/models/SsgOptions.d.ts +1 -3
- package/dist/models/StrictTransportSecurity.d.ts +1 -3
- package/dist/models/XFrameOptions.d.ts +1 -3
- package/dist/models/XFrameOptions.js +1 -2
- package/dist/runtime/constants.d.ts +1 -3
- package/dist/runtime/constants.js +1 -2
- package/dist/runtime/nitro/plugins/hidePoweredBy.d.ts +0 -2
- package/dist/runtime/nitro/plugins/hidePoweredBy.js +1 -2
- package/dist/runtime/nitro/plugins/nonce.d.ts +0 -2
- package/dist/runtime/nitro/plugins/nonce.js +1 -2
- package/dist/runtime/nitro/plugins/routeRules.d.ts +1 -3
- package/dist/runtime/nitro/plugins/routeRules.js +1 -2
- package/dist/runtime/nitro/plugins/securityHeaders.d.ts +0 -2
- package/dist/runtime/nitro/plugins/securityHeaders.js +1 -2
- package/dist/runtime/nitro/plugins/ssgHashes.d.ts +0 -2
- package/dist/runtime/nitro/plugins/ssgHashes.js +1 -2
- package/dist/runtime/nitro/plugins/subresourceIntegrity.d.ts +1 -3
- package/dist/runtime/nitro/plugins/subresourceIntegrity.js +1 -2
- package/dist/runtime/server/middleware/allowedMethodsRestricter.d.ts +0 -2
- package/dist/runtime/server/middleware/allowedMethodsRestricter.js +1 -2
- package/dist/runtime/server/middleware/basicAuth.d.ts +0 -2
- package/dist/runtime/server/middleware/basicAuth.js +1 -2
- package/dist/runtime/server/middleware/corsHandler.d.ts +0 -2
- package/dist/runtime/server/middleware/corsHandler.js +1 -2
- package/dist/runtime/server/middleware/csrf.d.ts +0 -2
- package/dist/runtime/server/middleware/csrf.js +1 -2
- package/dist/runtime/server/middleware/rateLimiter.d.ts +0 -2
- package/dist/runtime/server/middleware/rateLimiter.js +1 -2
- package/dist/runtime/server/middleware/requestSizeLimiter.d.ts +0 -2
- package/dist/runtime/server/middleware/requestSizeLimiter.js +1 -2
- package/dist/runtime/services/checkIsBasicAuthorized.d.ts +1 -3
- package/dist/runtime/services/checkIsBasicAuthorized.js +1 -2
- package/dist/runtime/services/checkIsChallenged.d.ts +1 -3
- package/dist/runtime/services/checkIsChallenged.js +1 -2
- package/dist/runtime/services/checkIsCsrfTokenValid.d.ts +1 -3
- package/dist/runtime/services/checkIsCsrfTokenValid.js +1 -2
- package/dist/runtime/services/checkIsEqualInConstantTime.d.ts +1 -3
- package/dist/runtime/services/checkIsEqualInConstantTime.js +1 -2
- package/dist/runtime/services/checkIsMethodAllowed.d.ts +1 -3
- package/dist/runtime/services/checkIsMethodAllowed.js +1 -2
- package/dist/runtime/services/checkIsRecord.d.ts +1 -3
- package/dist/runtime/services/checkIsRecord.js +1 -2
- package/dist/runtime/services/checkIsRequestTooLarge.d.ts +1 -3
- package/dist/runtime/services/checkIsRequestTooLarge.js +1 -2
- package/dist/runtime/services/collectSsgHashes.d.ts +1 -3
- package/dist/runtime/services/collectSsgHashes.js +1 -2
- package/dist/runtime/services/createInMemoryRateLimiterStore.d.ts +1 -3
- package/dist/runtime/services/createInMemoryRateLimiterStore.js +1 -2
- package/dist/runtime/services/generateHash.d.ts +1 -3
- package/dist/runtime/services/generateHash.js +1 -2
- package/dist/runtime/services/generateNonce.d.ts +1 -3
- package/dist/runtime/services/generateNonce.js +1 -2
- package/dist/runtime/services/generateRandomToken.d.ts +1 -3
- package/dist/runtime/services/generateRandomToken.js +1 -2
- package/dist/runtime/services/getBasicAuthCredentials.d.ts +1 -3
- package/dist/runtime/services/getBasicAuthCredentials.js +1 -2
- package/dist/runtime/services/getBasicAuthOptions.d.ts +1 -3
- package/dist/runtime/services/getBasicAuthOptions.js +1 -2
- package/dist/runtime/services/getRetryAfterSeconds.d.ts +1 -3
- package/dist/runtime/services/getRetryAfterSeconds.js +1 -2
- package/dist/runtime/services/getSecurityRules.d.ts +1 -3
- package/dist/runtime/services/getSecurityRules.js +1 -2
- package/dist/runtime/services/getSecurityState.d.ts +1 -3
- package/dist/runtime/services/getSecurityState.js +1 -2
- package/dist/runtime/services/injectNonce.d.ts +1 -3
- package/dist/runtime/services/injectNonce.js +1 -2
- package/dist/runtime/services/injectSubresourceIntegrity.d.ts +1 -3
- package/dist/runtime/services/injectSubresourceIntegrity.js +1 -2
- package/dist/runtime/services/insertContentSecurityPolicyMeta.d.ts +1 -3
- package/dist/runtime/services/insertContentSecurityPolicyMeta.js +1 -2
- package/dist/runtime/services/mergeSecurityRules.d.ts +1 -3
- package/dist/runtime/services/mergeSecurityRules.js +1 -2
- package/dist/runtime/services/readHtmlTagAttribute.d.ts +1 -3
- package/dist/runtime/services/readHtmlTagAttribute.js +1 -2
- package/dist/runtime/services/rewriteHtmlTags.d.ts +1 -3
- package/dist/runtime/services/rewriteHtmlTags.js +1 -2
- package/dist/runtime/services/securityRouteMatcher.d.ts +1 -3
- package/dist/runtime/services/securityRouteMatcher.js +1 -2
- package/dist/runtime/services/serializeBasicAuthChallenge.d.ts +1 -3
- package/dist/runtime/services/serializeBasicAuthChallenge.js +1 -2
- package/dist/runtime/services/serializeContentSecurityPolicy.d.ts +1 -3
- package/dist/runtime/services/serializeContentSecurityPolicy.js +1 -2
- package/dist/runtime/services/serializePermissionsPolicy.d.ts +1 -3
- package/dist/runtime/services/serializePermissionsPolicy.js +1 -2
- package/dist/runtime/services/serializeSecurityHeaders.d.ts +1 -3
- package/dist/runtime/services/serializeSecurityHeaders.js +1 -2
- package/dist/runtime/services/serializeStrictTransportSecurity.d.ts +1 -3
- package/dist/runtime/services/serializeStrictTransportSecurity.js +1 -2
- package/dist/runtime/services/stripHtmlTagAttribute.d.ts +1 -3
- package/dist/runtime/services/stripHtmlTagAttribute.js +1 -2
- package/dist/runtime/services/updateContentSecurityPolicy.d.ts +1 -3
- package/dist/runtime/services/updateContentSecurityPolicy.js +1 -2
- package/dist/schemas/allowedMethodsRestricterOptionsSchema.js +1 -2
- package/dist/schemas/basicAuthOptionsSchema.js +1 -2
- package/dist/schemas/contentSecurityPolicySchema.js +1 -2
- package/dist/schemas/corsHandlerOptionsSchema.js +1 -2
- package/dist/schemas/csrfOptionsSchema.js +1 -2
- package/dist/schemas/moduleOptionsSchema.js +1 -2
- package/dist/schemas/permissionsPolicySchema.js +1 -2
- package/dist/schemas/rateLimiterOptionsSchema.js +1 -2
- package/dist/schemas/requestSizeLimiterOptionsSchema.js +1 -2
- package/dist/schemas/securityHeadersSchema.js +1 -2
- package/dist/schemas/ssgOptionsSchema.js +1 -2
- package/dist/schemas/strictTransportSecurityOptionsSchema.js +1 -2
- package/dist/services/computeSubresourceIntegrityHashes.js +1 -2
- package/dist/services/formatZodIssues.js +1 -2
- package/dist/services/getDefaultModuleOptions.js +1 -2
- package/dist/services/getDefaultSecurityHeaders.js +1 -2
- package/dist/services/getPluginTemplate.js +1 -2
- package/dist/services/getRemoveLoggersViteConfig.js +1 -2
- package/dist/services/getRouteRulesTemplate.js +1 -2
- package/dist/services/getRouteSecurityRules.js +1 -2
- package/dist/services/getStaticResourceHeaders.js +1 -2
- package/dist/services/getTypeTemplate.js +1 -2
- package/dist/services/mergeModuleOptions.js +1 -2
- package/dist/services/parseModuleOptions.js +1 -2
- package/package.json +4 -4
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { RequestSizeLimiterOptions } from "../../models/RequestSizeLimiterOptions.js";
|
|
2
|
-
|
|
3
|
-
export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, contentType: null | string, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }: RequestSizeLimiterOptions) => boolean;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const checkIsRequestTooLarge: (method: string, contentLength: null | string, contentType: null | string, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }: RequestSizeLimiterOptions) => boolean;
|
|
@@ -1,9 +1,8 @@
|
|
|
1
1
|
import { SIZE_LIMITED_METHODS } from "../constants.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/checkIsRequestTooLarge.ts
|
|
3
3
|
const checkIsRequestTooLarge = (method, contentLength, contentType, { maxRequestSizeInBytes, maxUploadFileRequestInBytes }) => {
|
|
4
4
|
if (!SIZE_LIMITED_METHODS.includes(method) || contentLength === null) return false;
|
|
5
5
|
const limit = contentType?.includes("multipart/form-data") ?? false ? maxUploadFileRequestInBytes : maxRequestSizeInBytes;
|
|
6
6
|
return Math.trunc(Number(contentLength)) >= limit;
|
|
7
7
|
};
|
|
8
|
-
//#endregion
|
|
9
8
|
export { checkIsRequestTooLarge };
|
|
@@ -1,5 +1,3 @@
|
|
|
1
1
|
import { SsgOptions } from "../../models/SsgOptions.js";
|
|
2
2
|
import { SecurityState } from "./getSecurityState.js";
|
|
3
|
-
|
|
4
|
-
export declare const collectSsgHashes: (html: string, options: SsgOptions) => Promise<SecurityState["hashes"]>;
|
|
5
|
-
//#endregion
|
|
3
|
+
export declare const collectSsgHashes: (html: string, options: SsgOptions) => Promise<SecurityState["hashes"]>;
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { CSP_HASH_ALGORITHM, HTML_TAG_REGEX } from "../constants.js";
|
|
2
2
|
import { generateHash } from "./generateHash.js";
|
|
3
3
|
import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
|
|
4
|
-
|
|
4
|
+
// src/runtime/services/collectSsgHashes.ts
|
|
5
5
|
const SCRIPT_PRELOAD_TYPES = /* @__PURE__ */ new Set([
|
|
6
6
|
"audioworklet",
|
|
7
7
|
"paintworklet",
|
|
@@ -37,5 +37,4 @@ const collectSsgHashes = async (html, options) => {
|
|
|
37
37
|
for (const hashSource of hashSources) if (hashSource) hashes[hashSource[0]].push(hashSource[1]);
|
|
38
38
|
return hashes;
|
|
39
39
|
};
|
|
40
|
-
//#endregion
|
|
41
40
|
export { collectSsgHashes };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { RateLimiterStore } from "../../models/RateLimiterStore.js";
|
|
2
|
-
|
|
3
|
-
export declare const createInMemoryRateLimiterStore: (maxEntries: number) => RateLimiterStore;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const createInMemoryRateLimiterStore: (maxEntries: number) => RateLimiterStore;
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/createInMemoryRateLimiterStore.ts
|
|
2
2
|
const createInMemoryRateLimiterStore = (maxEntries) => {
|
|
3
3
|
const windows = /* @__PURE__ */ new Map();
|
|
4
4
|
return { increment: (key, intervalInMilliseconds) => {
|
|
@@ -18,5 +18,4 @@ const createInMemoryRateLimiterStore = (maxEntries) => {
|
|
|
18
18
|
return Promise.resolve(window);
|
|
19
19
|
} };
|
|
20
20
|
};
|
|
21
|
-
//#endregion
|
|
22
21
|
export { createInMemoryRateLimiterStore };
|
|
@@ -1,3 +1 @@
|
|
|
1
|
-
|
|
2
|
-
export declare const generateHash: (content: string | Uint8Array, hashAlgorithm: string) => Promise<string>;
|
|
3
|
-
//#endregion
|
|
1
|
+
export declare const generateHash: (content: string | Uint8Array, hashAlgorithm: string) => Promise<string>;
|
|
@@ -1,9 +1,8 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/generateHash.ts
|
|
2
2
|
const generateHash = async (content, hashAlgorithm) => {
|
|
3
3
|
const bytes = typeof content === "string" ? new TextEncoder().encode(content) : new Uint8Array(content);
|
|
4
4
|
const hashBuffer = await globalThis.crypto.subtle.digest(hashAlgorithm, bytes);
|
|
5
5
|
const base64 = btoa(String.fromCodePoint(...new Uint8Array(hashBuffer)));
|
|
6
6
|
return `${hashAlgorithm.replace("-", "").toLowerCase()}-${base64}`;
|
|
7
7
|
};
|
|
8
|
-
//#endregion
|
|
9
8
|
export { generateHash };
|
|
@@ -1,6 +1,5 @@
|
|
|
1
1
|
import "../constants.js";
|
|
2
2
|
import { generateRandomToken } from "./generateRandomToken.js";
|
|
3
|
-
|
|
3
|
+
// src/runtime/services/generateNonce.ts
|
|
4
4
|
const generateNonce = () => generateRandomToken(18);
|
|
5
|
-
//#endregion
|
|
6
5
|
export { generateNonce };
|
|
@@ -1,8 +1,7 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/generateRandomToken.ts
|
|
2
2
|
const generateRandomToken = (byteLength) => {
|
|
3
3
|
const bytes = new Uint8Array(byteLength);
|
|
4
4
|
globalThis.crypto.getRandomValues(bytes);
|
|
5
5
|
return btoa(String.fromCodePoint(...bytes)).replaceAll("+", "-").replaceAll("/", "_").replace(/[=]+$/u, "");
|
|
6
6
|
};
|
|
7
|
-
//#endregion
|
|
8
7
|
export { generateRandomToken };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { BASIC_AUTHORIZATION_SCHEME } from "../constants.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/getBasicAuthCredentials.ts
|
|
3
3
|
const BASE64_REGEX = /^[\d+/A-Za-z]*={0,2}$/u;
|
|
4
4
|
const BASE64_QUANTUM_LENGTH = 4;
|
|
5
5
|
const checkIsBase64 = (value) => BASE64_REGEX.test(value) && (value.endsWith("=") ? value.length % BASE64_QUANTUM_LENGTH === 0 : value.length % BASE64_QUANTUM_LENGTH !== 1);
|
|
@@ -15,5 +15,4 @@ const getBasicAuthCredentials = (authorization) => {
|
|
|
15
15
|
pass: decoded.slice(separatorIndex + 1)
|
|
16
16
|
};
|
|
17
17
|
};
|
|
18
|
-
//#endregion
|
|
19
18
|
export { getBasicAuthCredentials };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { BasicAuthOptions } from "../../models/BasicAuthOptions.js";
|
|
2
|
-
|
|
3
|
-
export declare const getBasicAuthOptions: (privateRuntimeConfig: unknown) => BasicAuthOptions | undefined;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const getBasicAuthOptions: (privateRuntimeConfig: unknown) => BasicAuthOptions | undefined;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { checkIsRecord } from "./checkIsRecord.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/getBasicAuthOptions.ts
|
|
3
3
|
const checkIsStringList = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
|
|
4
4
|
const getBasicAuthOptions = (privateRuntimeConfig) => {
|
|
5
5
|
if (!checkIsRecord(privateRuntimeConfig) || !checkIsRecord(privateRuntimeConfig.basicAuth)) return void 0;
|
|
@@ -13,5 +13,4 @@ const getBasicAuthOptions = (privateRuntimeConfig) => {
|
|
|
13
13
|
pass
|
|
14
14
|
};
|
|
15
15
|
};
|
|
16
|
-
//#endregion
|
|
17
16
|
export { getBasicAuthOptions };
|
|
@@ -1,5 +1,3 @@
|
|
|
1
1
|
import { RateLimiterOptions } from "../../models/RateLimiterOptions.js";
|
|
2
2
|
import { RateLimiterStore } from "../../models/RateLimiterStore.js";
|
|
3
|
-
|
|
4
|
-
export declare const getRetryAfterSeconds: (store: RateLimiterStore, key: string, { intervalInMilliseconds, tokensPerInterval }: RateLimiterOptions) => Promise<number | undefined>;
|
|
5
|
-
//#endregion
|
|
3
|
+
export declare const getRetryAfterSeconds: (store: RateLimiterStore, key: string, { intervalInMilliseconds, tokensPerInterval }: RateLimiterOptions) => Promise<number | undefined>;
|
|
@@ -1,9 +1,8 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/getRetryAfterSeconds.ts
|
|
2
2
|
const MILLISECONDS_PER_SECOND = 1e3;
|
|
3
3
|
const getRetryAfterSeconds = async (store, key, { intervalInMilliseconds, tokensPerInterval }) => {
|
|
4
4
|
const { count, resetAt } = await store.increment(key, intervalInMilliseconds);
|
|
5
5
|
if (count <= tokensPerInterval) return void 0;
|
|
6
6
|
return Math.max(1, Math.ceil((resetAt - Date.now()) / MILLISECONDS_PER_SECOND));
|
|
7
7
|
};
|
|
8
|
-
//#endregion
|
|
9
8
|
export { getRetryAfterSeconds };
|
|
@@ -1,5 +1,3 @@
|
|
|
1
1
|
import { SecurityRules } from "../../models/SecurityRules.js";
|
|
2
2
|
import { H3Event } from "nitro/h3";
|
|
3
|
-
|
|
4
|
-
export declare const getSecurityRules: (event: H3Event) => SecurityRules | undefined;
|
|
5
|
-
//#endregion
|
|
3
|
+
export declare const getSecurityRules: (event: H3Event) => SecurityRules | undefined;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { mergeSecurityRules } from "./mergeSecurityRules.js";
|
|
2
2
|
import { findSecurityRules } from "./securityRouteMatcher.js";
|
|
3
|
-
|
|
3
|
+
// src/runtime/services/getSecurityRules.ts
|
|
4
4
|
const securityRulesByEvent = /* @__PURE__ */ new WeakMap();
|
|
5
5
|
const getSecurityRules = (event) => {
|
|
6
6
|
const cachedRules = securityRulesByEvent.get(event);
|
|
@@ -11,5 +11,4 @@ const getSecurityRules = (event) => {
|
|
|
11
11
|
securityRulesByEvent.set(event, rules);
|
|
12
12
|
return rules;
|
|
13
13
|
};
|
|
14
|
-
//#endregion
|
|
15
14
|
export { getSecurityRules };
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { H3Event } from "nitro/h3";
|
|
2
|
-
//#region src/runtime/services/getSecurityState.d.ts
|
|
3
2
|
export interface SecurityState {
|
|
4
3
|
hashes: {
|
|
5
4
|
script: string[];
|
|
@@ -7,5 +6,4 @@ export interface SecurityState {
|
|
|
7
6
|
};
|
|
8
7
|
nonce?: string;
|
|
9
8
|
}
|
|
10
|
-
export declare const getSecurityState: (event: H3Event) => SecurityState;
|
|
11
|
-
//#endregion
|
|
9
|
+
export declare const getSecurityState: (event: H3Event) => SecurityState;
|
|
@@ -1,4 +1,4 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/getSecurityState.ts
|
|
2
2
|
const securityStateByEvent = /* @__PURE__ */ new WeakMap();
|
|
3
3
|
const getSecurityState = (event) => {
|
|
4
4
|
const cachedState = securityStateByEvent.get(event);
|
|
@@ -10,5 +10,4 @@ const getSecurityState = (event) => {
|
|
|
10
10
|
securityStateByEvent.set(event, state);
|
|
11
11
|
return state;
|
|
12
12
|
};
|
|
13
|
-
//#endregion
|
|
14
13
|
export { getSecurityState };
|
|
@@ -1,7 +1,6 @@
|
|
|
1
1
|
import { NONCE_TAG_NAMES } from "../constants.js";
|
|
2
2
|
import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
|
|
3
3
|
import { stripHtmlTagAttribute } from "./stripHtmlTagAttribute.js";
|
|
4
|
-
|
|
4
|
+
// src/runtime/services/injectNonce.ts
|
|
5
5
|
const injectNonce = (html, nonce) => rewriteHtmlTags(html, (tagName, attributes) => NONCE_TAG_NAMES.includes(tagName.toLowerCase()) ? ` nonce="${nonce}"${stripHtmlTagAttribute(attributes, "nonce")}` : void 0);
|
|
6
|
-
//#endregion
|
|
7
6
|
export { injectNonce };
|
|
@@ -1,3 +1 @@
|
|
|
1
|
-
|
|
2
|
-
export declare const injectSubresourceIntegrity: (html: string, hashes: Record<string, string>) => string;
|
|
3
|
-
//#endregion
|
|
1
|
+
export declare const injectSubresourceIntegrity: (html: string, hashes: Record<string, string>) => string;
|
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
import { readHtmlTagAttribute } from "./readHtmlTagAttribute.js";
|
|
2
2
|
import { rewriteHtmlTags } from "./rewriteHtmlTags.js";
|
|
3
|
-
|
|
3
|
+
// src/runtime/services/injectSubresourceIntegrity.ts
|
|
4
4
|
const RESOURCE_ATTRIBUTE_NAMES = {
|
|
5
5
|
link: "href",
|
|
6
6
|
script: "src"
|
|
@@ -18,5 +18,4 @@ const injectSubresourceIntegrity = (html, hashes) => rewriteHtmlTags(html, (tagN
|
|
|
18
18
|
if (tagName.toLowerCase() === "link" && !INTEGRITY_LINK_RELS.has(readHtmlTagAttribute(attributes, "rel") ?? "")) return void 0;
|
|
19
19
|
return ` integrity="${hashes[resource]}"${attributes}`;
|
|
20
20
|
});
|
|
21
|
-
//#endregion
|
|
22
21
|
export { injectSubresourceIntegrity };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
|
|
2
|
-
|
|
3
|
-
export declare const insertContentSecurityPolicyMeta: (html: string, policy: ContentSecurityPolicy) => string;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const insertContentSecurityPolicyMeta: (html: string, policy: ContentSecurityPolicy) => string;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/insertContentSecurityPolicyMeta.ts
|
|
3
3
|
const META_CONTENT_SECURITY_POLICY_REGEX = /<meta\s+http-equiv=["']Content-Security-Policy["'][^>]*>/iu;
|
|
4
4
|
const HEAD_CHARSET_REGEX = /<meta\s+charset=["'][^"']*["'][^>]*>/iu;
|
|
5
5
|
const HEAD_OPEN_REGEX = /<head\b[^>]*>/iu;
|
|
@@ -13,5 +13,4 @@ const insertContentSecurityPolicyMeta = (html, policy) => {
|
|
|
13
13
|
const insertAt = insertion ? insertion.index + insertion[0].length : 0;
|
|
14
14
|
return html.slice(0, insertAt) + metaTag + html.slice(insertAt);
|
|
15
15
|
};
|
|
16
|
-
//#endregion
|
|
17
16
|
export { insertContentSecurityPolicyMeta };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { SecurityRules } from "../../models/SecurityRules.js";
|
|
2
|
-
|
|
3
|
-
export declare const mergeSecurityRules: (...rules: SecurityRules[]) => SecurityRules;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const mergeSecurityRules: (...rules: SecurityRules[]) => SecurityRules;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { createDefu } from "defu";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/mergeSecurityRules.ts
|
|
3
3
|
const mergeRulesWithReplacedArrays = createDefu((object, key, value) => {
|
|
4
4
|
if (Array.isArray(object[key]) || Array.isArray(value)) {
|
|
5
5
|
object[key] = value;
|
|
@@ -7,5 +7,4 @@ const mergeRulesWithReplacedArrays = createDefu((object, key, value) => {
|
|
|
7
7
|
}
|
|
8
8
|
});
|
|
9
9
|
const mergeSecurityRules = (...rules) => mergeRulesWithReplacedArrays({}, ...rules);
|
|
10
|
-
//#endregion
|
|
11
10
|
export { mergeSecurityRules };
|
|
@@ -1,3 +1 @@
|
|
|
1
|
-
|
|
2
|
-
export declare const readHtmlTagAttribute: (attributes: string, attributeName: string) => string | undefined;
|
|
3
|
-
//#endregion
|
|
1
|
+
export declare const readHtmlTagAttribute: (attributes: string, attributeName: string) => string | undefined;
|
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/readHtmlTagAttribute.ts
|
|
3
3
|
const readHtmlTagAttribute = (attributes, attributeName) => {
|
|
4
4
|
for (const [, name, , value] of attributes.matchAll(HTML_ATTRIBUTE_REGEX)) if (name?.toLowerCase() === attributeName) return unquote(value ?? "");
|
|
5
5
|
};
|
|
6
6
|
const unquote = (value) => value.replace(/^(?<quote>["'])(?<inner>.*)\k<quote>$/su, "$<inner>");
|
|
7
|
-
//#endregion
|
|
8
7
|
export { readHtmlTagAttribute };
|
|
@@ -1,3 +1 @@
|
|
|
1
|
-
|
|
2
|
-
export declare const rewriteHtmlTags: (html: string, rewriteAttributes: (tagName: string, attributes: string) => string | undefined) => string;
|
|
3
|
-
//#endregion
|
|
1
|
+
export declare const rewriteHtmlTags: (html: string, rewriteAttributes: (tagName: string, attributes: string) => string | undefined) => string;
|
|
@@ -1,9 +1,8 @@
|
|
|
1
1
|
import { HTML_TAG_REGEX } from "../constants.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/rewriteHtmlTags.ts
|
|
3
3
|
const rewriteHtmlTags = (html, rewriteAttributes) => html.replace(HTML_TAG_REGEX, (match, elementName, elementAttributes, elementTrailer, body, tagName, tagAttributes, tagTrailer) => {
|
|
4
4
|
if (elementName) return `<${elementName}${rewriteAttributes(elementName, elementAttributes ?? "") ?? elementAttributes}${elementTrailer}>${body}</${elementName}>`;
|
|
5
5
|
const attributes = rewriteAttributes(tagName ?? "", tagAttributes ?? "");
|
|
6
6
|
return attributes === void 0 ? match : `<${tagName}${attributes}${tagTrailer}>`;
|
|
7
7
|
});
|
|
8
|
-
//#endregion
|
|
9
8
|
export { rewriteHtmlTags };
|
|
@@ -1,5 +1,3 @@
|
|
|
1
1
|
import { SecurityRules } from "../../models/SecurityRules.js";
|
|
2
|
-
//#region src/runtime/services/securityRouteMatcher.d.ts
|
|
3
2
|
export declare const setSecurityRouteMatcher: (routes: Record<string, SecurityRules>) => void;
|
|
4
|
-
export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;
|
|
5
|
-
//#endregion
|
|
3
|
+
export declare const findSecurityRules: (pathname: string) => SecurityRules[] | undefined;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { addRoute, createRouter, findAllRoutes } from "rou3";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/securityRouteMatcher.ts
|
|
3
3
|
let securityRouter;
|
|
4
4
|
const setSecurityRouteMatcher = (routes) => {
|
|
5
5
|
const router = createRouter();
|
|
@@ -7,5 +7,4 @@ const setSecurityRouteMatcher = (routes) => {
|
|
|
7
7
|
securityRouter = router;
|
|
8
8
|
};
|
|
9
9
|
const findSecurityRules = (pathname) => securityRouter && findAllRoutes(securityRouter, "", pathname).flatMap(({ data }) => data ? [data] : []);
|
|
10
|
-
//#endregion
|
|
11
10
|
export { findSecurityRules, setSecurityRouteMatcher };
|
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/serializeBasicAuthChallenge.ts
|
|
2
2
|
const serializeBasicAuthChallenge = (realm) => `Basic realm="${realm.replaceAll(/["\\]/gu, String.raw`\$&`)}"`;
|
|
3
|
-
//#endregion
|
|
4
3
|
export { serializeBasicAuthChallenge };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
|
|
2
|
-
|
|
3
|
-
export declare const serializeContentSecurityPolicy: (policy: ContentSecurityPolicy) => string;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const serializeContentSecurityPolicy: (policy: ContentSecurityPolicy) => string;
|
|
@@ -1,7 +1,6 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/serializeContentSecurityPolicy.ts
|
|
2
2
|
const serializeContentSecurityPolicy = (policy) => Object.entries(policy).filter(([, value]) => value !== false).map(([directive, value]) => {
|
|
3
3
|
if (directive === "upgrade-insecure-requests") return "upgrade-insecure-requests;";
|
|
4
4
|
return `${directive} ${Array.isArray(value) ? value.map((source) => source.trim()).join(" ") : ""};`;
|
|
5
5
|
}).join(" ");
|
|
6
|
-
//#endregion
|
|
7
6
|
export { serializeContentSecurityPolicy };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { PermissionsPolicy } from "../../models/PermissionsPolicy.js";
|
|
2
|
-
|
|
3
|
-
export declare const serializePermissionsPolicy: (policy: PermissionsPolicy) => string;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const serializePermissionsPolicy: (policy: PermissionsPolicy) => string;
|
|
@@ -1,4 +1,3 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/serializePermissionsPolicy.ts
|
|
2
2
|
const serializePermissionsPolicy = (policy) => Object.entries(policy).flatMap(([feature, sources]) => sources === false ? [] : [`${feature}=(${(sources ?? []).join(" ")})`]).join(", ");
|
|
3
|
-
//#endregion
|
|
4
3
|
export { serializePermissionsPolicy };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { SecurityHeaders } from "../../models/SecurityHeaders.js";
|
|
2
|
-
|
|
3
|
-
export declare const serializeSecurityHeaders: (headers: SecurityHeaders) => Record<string, string>;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const serializeSecurityHeaders: (headers: SecurityHeaders) => Record<string, string>;
|
|
@@ -2,7 +2,7 @@ import { SECURITY_HEADER_NAMES } from "../constants.js";
|
|
|
2
2
|
import { serializeContentSecurityPolicy } from "./serializeContentSecurityPolicy.js";
|
|
3
3
|
import { serializePermissionsPolicy } from "./serializePermissionsPolicy.js";
|
|
4
4
|
import { serializeStrictTransportSecurity } from "./serializeStrictTransportSecurity.js";
|
|
5
|
-
|
|
5
|
+
// src/runtime/services/serializeSecurityHeaders.ts
|
|
6
6
|
const checkIsSecurityHeaderKey = (key) => Object.hasOwn(SECURITY_HEADER_NAMES, key);
|
|
7
7
|
const serializeSecurityHeaders = (headers) => Object.fromEntries(Object.keys(headers).flatMap((key) => {
|
|
8
8
|
if (!checkIsSecurityHeaderKey(key)) return [];
|
|
@@ -15,5 +15,4 @@ const serializeValue = (key, value) => {
|
|
|
15
15
|
if (key === "strictTransportSecurity") return serializeStrictTransportSecurity(value);
|
|
16
16
|
return String(value);
|
|
17
17
|
};
|
|
18
|
-
//#endregion
|
|
19
18
|
export { serializeSecurityHeaders };
|
|
@@ -1,4 +1,2 @@
|
|
|
1
1
|
import { StrictTransportSecurity } from "../../models/StrictTransportSecurity.js";
|
|
2
|
-
|
|
3
|
-
export declare const serializeStrictTransportSecurity: (policy: StrictTransportSecurity) => string;
|
|
4
|
-
//#endregion
|
|
2
|
+
export declare const serializeStrictTransportSecurity: (policy: StrictTransportSecurity) => string;
|
|
@@ -1,8 +1,7 @@
|
|
|
1
|
-
|
|
1
|
+
// src/runtime/services/serializeStrictTransportSecurity.ts
|
|
2
2
|
const serializeStrictTransportSecurity = (policy) => [
|
|
3
3
|
`max-age=${policy.maxAge}`,
|
|
4
4
|
policy.includeSubdomains && "includeSubDomains",
|
|
5
5
|
policy.preload && "preload"
|
|
6
6
|
].filter(Boolean).join("; ");
|
|
7
|
-
//#endregion
|
|
8
7
|
export { serializeStrictTransportSecurity };
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { HTML_ATTRIBUTE_REGEX } from "../constants.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/stripHtmlTagAttribute.ts
|
|
3
3
|
const stripHtmlTagAttribute = (attributes, attributeName) => attributes.replace(HTML_ATTRIBUTE_REGEX, (token, name) => name.toLowerCase() === attributeName ? "" : token);
|
|
4
|
-
//#endregion
|
|
5
4
|
export { stripHtmlTagAttribute };
|
|
@@ -1,5 +1,3 @@
|
|
|
1
1
|
import { ContentSecurityPolicy } from "../../models/ContentSecurityPolicy.js";
|
|
2
2
|
import { SecurityState } from "./getSecurityState.js";
|
|
3
|
-
|
|
4
|
-
export declare const updateContentSecurityPolicy: (policy: ContentSecurityPolicy, { hashes, nonce }: SecurityState) => ContentSecurityPolicy;
|
|
5
|
-
//#endregion
|
|
3
|
+
export declare const updateContentSecurityPolicy: (policy: ContentSecurityPolicy, { hashes, nonce }: SecurityState) => ContentSecurityPolicy;
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { NONCE_PLACEHOLDER } from "../constants.js";
|
|
2
|
-
|
|
2
|
+
// src/runtime/services/updateContentSecurityPolicy.ts
|
|
3
3
|
const SCRIPT_DIRECTIVES = /* @__PURE__ */ new Set(["script-src", "script-src-elem"]);
|
|
4
4
|
const STYLE_DIRECTIVES = /* @__PURE__ */ new Set(["style-src", "style-src-elem"]);
|
|
5
5
|
const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEntries(Object.keys(policy).map((directive) => {
|
|
@@ -11,5 +11,4 @@ const updateContentSecurityPolicy = (policy, { hashes, nonce }) => Object.fromEn
|
|
|
11
11
|
return [directive, sources];
|
|
12
12
|
}));
|
|
13
13
|
const checkIsStaticNonce = (source) => source.startsWith("'nonce-") && source !== "'nonce-{{nonce}}'";
|
|
14
|
-
//#endregion
|
|
15
14
|
export { updateContentSecurityPolicy };
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/allowedMethodsRestricterOptionsSchema.ts
|
|
3
3
|
const allowedMethodsRestricterOptionsSchema = z.strictObject({ methods: z.array(z.string().min(1)).min(1) });
|
|
4
|
-
//#endregion
|
|
5
4
|
export { allowedMethodsRestricterOptionsSchema };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/basicAuthOptionsSchema.ts
|
|
3
3
|
const pathSchema = z.string().startsWith("/");
|
|
4
4
|
const basicAuthOptionsSchema = z.strictObject({
|
|
5
5
|
exclude: z.array(pathSchema).optional(),
|
|
@@ -8,5 +8,4 @@ const basicAuthOptionsSchema = z.strictObject({
|
|
|
8
8
|
name: z.string().min(1),
|
|
9
9
|
pass: z.string().min(1)
|
|
10
10
|
});
|
|
11
|
-
//#endregion
|
|
12
11
|
export { basicAuthOptionsSchema };
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/contentSecurityPolicySchema.ts
|
|
3
3
|
const contentSecurityPolicySchema = z.record(z.string().min(1), z.union([z.boolean(), z.array(z.string().min(1))]).optional());
|
|
4
|
-
//#endregion
|
|
5
4
|
export { contentSecurityPolicySchema };
|
|
@@ -1,5 +1,5 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/corsHandlerOptionsSchema.ts
|
|
3
3
|
const headerNameSchema = z.string().regex(/^[\w-]+$/u);
|
|
4
4
|
const corsHandlerOptionsSchema = z.strictObject({
|
|
5
5
|
allowHeaders: z.array(headerNameSchema).optional(),
|
|
@@ -10,5 +10,4 @@ const corsHandlerOptionsSchema = z.strictObject({
|
|
|
10
10
|
origin: z.union([z.url(), z.array(z.url())]),
|
|
11
11
|
preflight: z.strictObject({ statusCode: z.int().min(200).max(299) }).optional()
|
|
12
12
|
});
|
|
13
|
-
//#endregion
|
|
14
13
|
export { corsHandlerOptionsSchema };
|
|
@@ -1,9 +1,8 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/csrfOptionsSchema.ts
|
|
3
3
|
const tokenNameSchema = z.string().regex(/^[\w-]+$/u, "must be letters, digits, underscores or hyphens");
|
|
4
4
|
const csrfOptionsSchema = z.strictObject({
|
|
5
5
|
cookieName: tokenNameSchema,
|
|
6
6
|
headerName: tokenNameSchema
|
|
7
7
|
});
|
|
8
|
-
//#endregion
|
|
9
8
|
export { csrfOptionsSchema };
|
|
@@ -7,7 +7,7 @@ import { requestSizeLimiterOptionsSchema } from "./requestSizeLimiterOptionsSche
|
|
|
7
7
|
import { securityHeadersSchema } from "./securityHeadersSchema.js";
|
|
8
8
|
import { ssgOptionsSchema } from "./ssgOptionsSchema.js";
|
|
9
9
|
import { z } from "zod";
|
|
10
|
-
|
|
10
|
+
// src/schemas/moduleOptionsSchema.ts
|
|
11
11
|
const moduleOptionsSchema = z.strictObject({
|
|
12
12
|
allowedMethodsRestricter: z.union([allowedMethodsRestricterOptionsSchema, z.literal(false)]),
|
|
13
13
|
basicAuth: z.union([basicAuthOptionsSchema, z.literal(false)]),
|
|
@@ -25,5 +25,4 @@ const moduleOptionsSchema = z.strictObject({
|
|
|
25
25
|
ssg: z.union([ssgOptionsSchema, z.literal(false)]),
|
|
26
26
|
strict: z.boolean()
|
|
27
27
|
});
|
|
28
|
-
//#endregion
|
|
29
28
|
export { moduleOptionsSchema };
|
|
@@ -1,5 +1,4 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/permissionsPolicySchema.ts
|
|
3
3
|
const permissionsPolicySchema = z.record(z.string().min(1), z.union([z.literal(false), z.array(z.string().min(1))]).optional());
|
|
4
|
-
//#endregion
|
|
5
4
|
export { permissionsPolicySchema };
|
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/rateLimiterOptionsSchema.ts
|
|
3
3
|
const rateLimiterOptionsSchema = z.strictObject({
|
|
4
4
|
intervalInMilliseconds: z.int("must be a whole number of milliseconds").positive("must be more than zero milliseconds"),
|
|
5
5
|
tokensPerInterval: z.int("must be a whole number of requests").positive("must allow at least one request")
|
|
6
6
|
});
|
|
7
|
-
//#endregion
|
|
8
7
|
export { rateLimiterOptionsSchema };
|
|
@@ -1,8 +1,7 @@
|
|
|
1
1
|
import { z } from "zod";
|
|
2
|
-
|
|
2
|
+
// src/schemas/requestSizeLimiterOptionsSchema.ts
|
|
3
3
|
const requestSizeLimiterOptionsSchema = z.strictObject({
|
|
4
4
|
maxRequestSizeInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes"),
|
|
5
5
|
maxUploadFileRequestInBytes: z.int("must be a whole number of bytes").positive("must be more than zero bytes")
|
|
6
6
|
});
|
|
7
|
-
//#endregion
|
|
8
7
|
export { requestSizeLimiterOptionsSchema };
|