tw-framework 1.0.8 → 1.0.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/testing.cjs +4 -3
- package/dist/tw-server.mjs +4 -3
- package/dist/tw.mjs +4 -3
- package/package.json +1 -1
package/dist/testing.cjs
CHANGED
|
@@ -24545,7 +24545,7 @@ var init_types4 = __esm({
|
|
|
24545
24545
|
var TW_VERSION, TW_GENERATOR_META;
|
|
24546
24546
|
var init_version = __esm({
|
|
24547
24547
|
"../../packages/compiler/tw/codegen/version.ts"() {
|
|
24548
|
-
TW_VERSION = "1.0.
|
|
24548
|
+
TW_VERSION = "1.0.9";
|
|
24549
24549
|
TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
|
|
24550
24550
|
}
|
|
24551
24551
|
});
|
|
@@ -44461,7 +44461,7 @@ function securityHeadersMiddleware2(opts) {
|
|
|
44461
44461
|
ctx.headers["referrer-policy"] = "strict-origin-when-cross-origin";
|
|
44462
44462
|
ctx.headers["permissions-policy"] = "camera=(), microphone=(), geolocation=()";
|
|
44463
44463
|
if (opts?.csp !== false && !ctx.headers["content-security-policy"]) {
|
|
44464
|
-
ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
44464
|
+
ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
44465
44465
|
}
|
|
44466
44466
|
await next();
|
|
44467
44467
|
};
|
|
@@ -49546,7 +49546,8 @@ function devSecurityHeaders() {
|
|
|
49546
49546
|
var BASELINE_CSP, DEFAULTS2, SecurityHeaders2;
|
|
49547
49547
|
var init_security_headers = __esm({
|
|
49548
49548
|
"../../packages/security/tw/headers/security-headers.ts"() {
|
|
49549
|
-
BASELINE_CSP =
|
|
49549
|
+
BASELINE_CSP = // 'unsafe-eval' is needed: the client runtime evaluates state expressions and event handlers with new Function (packages/runtime/tw/client/hydration-runtime.js). Apps that precompile can drop it via the csp option.
|
|
49550
|
+
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
49550
49551
|
DEFAULTS2 = {
|
|
49551
49552
|
hstsMaxAge: 31536e3,
|
|
49552
49553
|
// 1 year
|
package/dist/tw-server.mjs
CHANGED
|
@@ -24011,7 +24011,7 @@ var init_types4 = __esm({
|
|
|
24011
24011
|
var TW_VERSION, TW_GENERATOR_META;
|
|
24012
24012
|
var init_version = __esm({
|
|
24013
24013
|
"../../packages/compiler/tw/codegen/version.ts"() {
|
|
24014
|
-
TW_VERSION = "1.0.
|
|
24014
|
+
TW_VERSION = "1.0.9";
|
|
24015
24015
|
TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
|
|
24016
24016
|
}
|
|
24017
24017
|
});
|
|
@@ -46498,7 +46498,8 @@ function devSecurityHeaders() {
|
|
|
46498
46498
|
var BASELINE_CSP, DEFAULTS2, SecurityHeaders2;
|
|
46499
46499
|
var init_security_headers = __esm({
|
|
46500
46500
|
"../../packages/security/tw/headers/security-headers.ts"() {
|
|
46501
|
-
BASELINE_CSP =
|
|
46501
|
+
BASELINE_CSP = // 'unsafe-eval' is needed: the client runtime evaluates state expressions and event handlers with new Function (packages/runtime/tw/client/hydration-runtime.js). Apps that precompile can drop it via the csp option.
|
|
46502
|
+
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
46502
46503
|
DEFAULTS2 = {
|
|
46503
46504
|
hstsMaxAge: 31536e3,
|
|
46504
46505
|
// 1 year
|
|
@@ -53956,7 +53957,7 @@ function securityHeadersMiddleware2(opts) {
|
|
|
53956
53957
|
ctx.headers["referrer-policy"] = "strict-origin-when-cross-origin";
|
|
53957
53958
|
ctx.headers["permissions-policy"] = "camera=(), microphone=(), geolocation=()";
|
|
53958
53959
|
if (opts?.csp !== false && !ctx.headers["content-security-policy"]) {
|
|
53959
|
-
ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
53960
|
+
ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
53960
53961
|
}
|
|
53961
53962
|
await next();
|
|
53962
53963
|
};
|
package/dist/tw.mjs
CHANGED
|
@@ -23094,7 +23094,7 @@ var init_types4 = __esm({
|
|
|
23094
23094
|
var TW_VERSION, TW_GENERATOR_META;
|
|
23095
23095
|
var init_version = __esm({
|
|
23096
23096
|
"../../packages/compiler/tw/codegen/version.ts"() {
|
|
23097
|
-
TW_VERSION = "1.0.
|
|
23097
|
+
TW_VERSION = "1.0.9";
|
|
23098
23098
|
TW_GENERATOR_META = `<meta name="generator" content="TW Framework ${TW_VERSION}">`;
|
|
23099
23099
|
}
|
|
23100
23100
|
});
|
|
@@ -44660,7 +44660,7 @@ function securityHeadersMiddleware2(opts) {
|
|
|
44660
44660
|
ctx.headers["referrer-policy"] = "strict-origin-when-cross-origin";
|
|
44661
44661
|
ctx.headers["permissions-policy"] = "camera=(), microphone=(), geolocation=()";
|
|
44662
44662
|
if (opts?.csp !== false && !ctx.headers["content-security-policy"]) {
|
|
44663
|
-
ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
44663
|
+
ctx.headers["content-security-policy"] = typeof opts?.csp === "string" ? opts.csp : "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
44664
44664
|
}
|
|
44665
44665
|
await next();
|
|
44666
44666
|
};
|
|
@@ -49745,7 +49745,8 @@ function devSecurityHeaders() {
|
|
|
49745
49745
|
var BASELINE_CSP, DEFAULTS2, SecurityHeaders2;
|
|
49746
49746
|
var init_security_headers = __esm({
|
|
49747
49747
|
"../../packages/security/tw/headers/security-headers.ts"() {
|
|
49748
|
-
BASELINE_CSP =
|
|
49748
|
+
BASELINE_CSP = // 'unsafe-eval' is needed: the client runtime evaluates state expressions and event handlers with new Function (packages/runtime/tw/client/hydration-runtime.js). Apps that precompile can drop it via the csp option.
|
|
49749
|
+
"default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; font-src 'self' data:; connect-src 'self'; media-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'";
|
|
49749
49750
|
DEFAULTS2 = {
|
|
49750
49751
|
hstsMaxAge: 31536e3,
|
|
49751
49752
|
// 1 year
|
package/package.json
CHANGED