From 2efc44e88345a8af895369b6e5102e3d008cc93d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9s=20Correa=20Casablanca?= Date: Mon, 29 Apr 2024 09:37:47 +0200 Subject: [PATCH 1/2] fix: do not autoquote csp directives Signed-off-by: Andres Correa Casablanca --- @kindspells/astro-shield/package.json | 2 +- @kindspells/astro-shield/src/headers.mjs | 7 +++---- .../astro-shield/tests/headers.test.mts | 19 +------------------ 3 files changed, 5 insertions(+), 23 deletions(-) diff --git a/@kindspells/astro-shield/package.json b/@kindspells/astro-shield/package.json index fe6c5dd..2994c35 100644 --- a/@kindspells/astro-shield/package.json +++ b/@kindspells/astro-shield/package.json @@ -1,6 +1,6 @@ { "name": "@kindspells/astro-shield", - "version": "1.3.5", + "version": "1.3.6", "description": "Astro integration to enhance your website's security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques.", "private": false, "type": "module", diff --git a/@kindspells/astro-shield/src/headers.mjs b/@kindspells/astro-shield/src/headers.mjs index edf1467..46c65c5 100644 --- a/@kindspells/astro-shield/src/headers.mjs +++ b/@kindspells/astro-shield/src/headers.mjs @@ -20,10 +20,9 @@ export const serialiseHashes = hashes => * @param {Set} hashes * @returns {string} */ -export const safeSerialiseHashes = hashes => +export const serializeCspDirectiveSources = hashes => Array.from(hashes) .sort() - .map(h => (h.match(/^'[^']+'$/i) ? h : `'${h}'`)) .join(' ') /** @@ -46,12 +45,12 @@ export const setSrcDirective = (directives, srcType, hashes) => { const baseSrcDirective = directives[srcType] if (baseSrcDirective) { const srcDirective = new Set( - baseSrcDirective.split(/\s+/).filter(v => v !== "'self'"), + baseSrcDirective.split(/\s+/), ) for (const hash of hashes) { srcDirective.add(`'${hash}'`) } - directives[srcType] = `'self' ${safeSerialiseHashes(srcDirective)}` + directives[srcType] = serializeCspDirectiveSources(srcDirective) } else { directives[srcType] = `'self' ${serialiseHashes(hashes)}` } diff --git a/@kindspells/astro-shield/tests/headers.test.mts b/@kindspells/astro-shield/tests/headers.test.mts index 3fed2cf..dbec0b4 100644 --- a/@kindspells/astro-shield/tests/headers.test.mts +++ b/@kindspells/astro-shield/tests/headers.test.mts @@ -9,7 +9,6 @@ import { describe, expect, it } from 'vitest' import { parseCspDirectives, patchHeaders, - safeSerialiseHashes, serialiseCspDirectives, serialiseHashes, setSrcDirective, @@ -35,22 +34,6 @@ describe('serialiseHashes', () => { }) }) -describe('safeSerialiseHashes', () => { - it('returns an empty string for an empty set', () => { - expect(safeSerialiseHashes(new Set())).toBe('') - }) - - it('returns a string with sorted hashes', () => { - const hashes = new Set(['d', 'c', 'a', 'b']) - expect(safeSerialiseHashes(hashes)).toBe("'a' 'b' 'c' 'd'") - }) - - it('avoids duplicated single quotes', () => { - const hashes = new Set(["'a'", "'b'", "'c'", "'d'"]) - expect(safeSerialiseHashes(hashes)).toBe("'a' 'b' 'c' 'd'") - }) -}) - describe('serialiseCspDirectives', () => { it('returns an empty string for an empty object', () => { expect(serialiseCspDirectives({})).toBe('') @@ -92,7 +75,7 @@ describe('setSrcDirective', () => { ) expect(directives['script-src']).toBe( - "'self' 'abc1' 'abc2' 'dbc1' 'xyz2' 'xyz3'", + "'abc1' 'abc2' 'dbc1' 'self' 'xyz2' 'xyz3'", ) }) }) From 3a4882bc537e6f9784a7192c2498ca0c7c0eda99 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Andr=C3=A9s=20Correa=20Casablanca?= Date: Mon, 29 Apr 2024 11:18:09 +0200 Subject: [PATCH 2/2] docs: upgrade website docs Signed-off-by: Andres Correa Casablanca --- @kindspells/astro-shield/package.json | 2 +- @kindspells/astro-shield/src/headers.mjs | 8 +- docs/astro.config.mjs | 8 ++ docs/package.json | 7 +- .../content-security-policy.mdx | 6 + docs/sst.config.ts | 4 +- docs/tsconfig.json | 3 +- pnpm-lock.yaml | 136 +++++++++--------- 8 files changed, 93 insertions(+), 81 deletions(-) diff --git a/@kindspells/astro-shield/package.json b/@kindspells/astro-shield/package.json index 2994c35..aacaa57 100644 --- a/@kindspells/astro-shield/package.json +++ b/@kindspells/astro-shield/package.json @@ -80,7 +80,7 @@ "url": "https://ko-fi.com/coderspirit" } ], - "packageManager": "pnpm@8.15.6", + "packageManager": "pnpm@9.0.6", "engines": { "node": ">= 18.0.0" }, diff --git a/@kindspells/astro-shield/src/headers.mjs b/@kindspells/astro-shield/src/headers.mjs index 46c65c5..df16aa5 100644 --- a/@kindspells/astro-shield/src/headers.mjs +++ b/@kindspells/astro-shield/src/headers.mjs @@ -21,9 +21,7 @@ export const serialiseHashes = hashes => * @returns {string} */ export const serializeCspDirectiveSources = hashes => - Array.from(hashes) - .sort() - .join(' ') + Array.from(hashes).sort().join(' ') /** * @param {CSPDirectives} directives @@ -44,9 +42,7 @@ export const serialiseCspDirectives = directives => export const setSrcDirective = (directives, srcType, hashes) => { const baseSrcDirective = directives[srcType] if (baseSrcDirective) { - const srcDirective = new Set( - baseSrcDirective.split(/\s+/), - ) + const srcDirective = new Set(baseSrcDirective.split(/\s+/)) for (const hash of hashes) { srcDirective.add(`'${hash}'`) } diff --git a/docs/astro.config.mjs b/docs/astro.config.mjs index 2b6305e..be34149 100644 --- a/docs/astro.config.mjs +++ b/docs/astro.config.mjs @@ -16,6 +16,10 @@ export default defineConfig({ image: { service: passthroughImageService(), }, + i18n: { + locales: ['en'], + defaultLocale: 'en', + }, integrations: [ shield({}), starlight({ @@ -26,6 +30,10 @@ export default defineConfig({ label: 'English', lang: 'en', }, + en: { + label: 'English', + lang: 'en', + }, }, social: { github: 'https://github.com/kindspells/astro-shield', diff --git a/docs/package.json b/docs/package.json index 00c4cf3..797aadb 100644 --- a/docs/package.json +++ b/docs/package.json @@ -3,11 +3,12 @@ "type": "module", "version": "1.4.0", "scripts": { - "dev": "sst dev astro dev", - "start": "astro dev", + "astro": "astro", "build": "moon run build", + "deploy":"sst deploy --stage prod", + "dev": "sst dev astro dev", "preview": "astro preview", - "astro": "astro" + "start": "astro dev" }, "dependencies": { "astro-sst": "^2.41.5", diff --git a/docs/src/content/docs/guides/security-headers/content-security-policy.mdx b/docs/src/content/docs/guides/security-headers/content-security-policy.mdx index 31f254e..79ef04b 100644 --- a/docs/src/content/docs/guides/security-headers/content-security-policy.mdx +++ b/docs/src/content/docs/guides/security-headers/content-security-policy.mdx @@ -58,6 +58,12 @@ export default defineConfig({ `} /> + +