yakuza0 2.20.12-beta.2 → 2.20.14

package/nuxt/head.js

@@ -28,6 +28,12 @@ var _config2 = _interopRequireDefault(_config);
 
 var _yakuza = require("yakuza1");
 
+var _syncRequest = require("sync-request");
+
+var _syncRequest2 = _interopRequireDefault(_syncRequest);
+
+var _crypto = require("crypto");
+
 function _interopRequireDefault(obj) { return obj && obj.__esModule ? obj : { default: obj }; }
 
 exports.default = function (config) {
@@ -51,6 +57,14 @@ exports.default = function (config) {
   var basePath = _yakuza._.bothAddFix(config.appConf.server.basePath, "/");
 
   _yakuza._.forEach(head, function (v, key) {
+    // switch (key) {
+    //   case "script":
+    //   case "style":
+    //
+    //     break;
+    //   default:
+    // }
+
     if ((typeof v === "undefined" ? "undefined" : (0, _typeof3.default)(v)) === 'object') {
       v = _yakuza._.map(v, function (gv) {
         if (_yakuza._.startsWith(gv.src, '/')) {
@@ -59,6 +73,29 @@ exports.default = function (config) {
         if (_yakuza._.startsWith(gv.href, '/')) {
           gv.href = basePath + _yakuza._.trimStart(gv.href, "/");
         }
+
+        var iUrl = gv.src || gv.href;
+        if ((_config2.default.security.isStupid || _config2.default.server.sriSwitch) && iUrl && _yakuza._.startsWith(iUrl, 'http')) {
+          try {
+            if (!gv.integrity) {
+              var res = (0, _syncRequest2.default)('GET', iUrl, {
+                timeout: parseInt(_config2.default.server.sriTimeout, 10) || 5000,
+                headers: {
+                  "Host": (0, _yakuza.jsUrl)('hostname', iUrl),
+                  "User-Agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.80 Safari/537.36"
+                }
+              });
+              var iBody = res.getBody('utf8');
+              var hash = (0, _crypto.createHash)('sha384').update(iBody).digest('base64');
+              gv.integrity = "sha384-" + hash;
+            }
+
+            if (gv.integrity) {
+              gv.crossorigin = "anonymous";
+            }
+          } catch (e) {}
+        }
+
         return gv;
       });
     }

package/nuxt/render/csp.js

@@ -18,7 +18,15 @@ exports.default = function (config) {
 
   var cspObj = {};
   _yakuza._.forEach(csp, function (v, key) {
-    cspObj[_yakuza._.kebabCase(key)] = v;
+    cspObj[_yakuza._.kebabCase(key)] = _yakuza._.compact(v.map(function (k) {
+      if (_config2.default.server.cspStrict) {
+        if (k === "*" || k.indexOf('*') !== -1 || k === "data:" || k === "'unsafe-eval'" || k === "'unsafe-inline'") {
+          return '';
+        }
+      }
+
+      return k;
+    }));
   });
 
   if (!_config2.default.security.stupid) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yakuza0",
-  "version": "2.20.12-beta.2",
+  "version": "2.20.14",
   "description": "yakuza0 with nuxt",
   "main": "index.js",
   "scripts": {
@@ -99,6 +99,7 @@
     "stylelint-webpack-plugin": "^3.1.0",
     "stylus": "^0.54.7",
     "stylus-loader": "^3.0.2",
+    "sync-request": "^6.1.0",
     "tcp-port-used": "^1.0.1",
     "ua-parser-js": "^0.7.20",
     "v8-compile-cache": "^2.0.2",

package/utils/inclusive.js

@@ -288,6 +288,9 @@ var render = function () {
                 autoOpenBrowser: true,
                 cookieSameSite: 'Lax',
                 cspSwitch: true,
+                cspStrict: false,
+                sriSwitch: false,
+                sriTimeout: 2000,
                 // ...mainConf.server,
                 // ...ykConf.server,
                 // csp,
@@ -466,7 +469,7 @@ var render = function () {
                     enabled: false,
                     eslint: {
                       enabled: true,
-                      test: ['vue', 'js'],
+                      test: ['vue'],
                       include: [],
                       exclude: [],
                       autoFixes: false,