Skip to content

feat(csp): resources for script and styles directives #13812

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
Parent: feat: experimental CSP
merged 5 commits into from
May 19, 2025
Merged

feat(csp): resources for script and styles directives #13812

merged 5 commits into from
May 19, 2025

Conversation

@ematipico
Copy link
Member

Changes

This PR implements the following chapter of the RFC: https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md#customize-the-script-src-and-style-src-directives

Changes:

  • The schema and validation of the hashes is now done via z.custom, which provides runtime validation and a better type check
  • I did some internal renaming
  • I refactored the code in order match the RFC. In the RFC I changed the structure of the configuration. From having styleHashes and styleResources, we now have styleDirective.hash and styleDirective.resources

Testing

I updated the validation test, since now we don't raise a custom message anymore.
Added new integration tests and updated the current ones.

Docs

@changeset-bot
Copy link

changeset-bot bot commented May 16, 2025 •
edited
Loading

⚠️ No Changeset found

Latest commit: 606fc05

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

@github-actions github-actions bot added pkg: astro Related to the core `astro` package (scope) docs pr labels May 16, 2025
ascorbic
ascorbic approved these changes May 19, 2025
View reviewed changes
Copy link
Contributor

@ascorbic ascorbic left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. It might be nice to adopt the same approach for typing and validating directives as a string in the config, rather than using the type/content object.

packages/astro/src/runtime/server/render/csp.ts

let scriptResources = "'self'";
if (result.scriptResources.length > 0) {
scriptResources = result.scriptResources.map((r) => `'${r}'`).join(' ');
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Are there scenarios where this could need escaping?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not that I'm aware of. URLs don't have apostrophes, and the other resources are well-known

@ematipico ematipico force-pushed the feat/csp-style-script-directives branch from f12f4be to 606fc05 Compare May 19, 2025 12:03
@ematipico
Copy link
Member Author

Looks good. It might be nice to adopt the same approach for typing and validating directives as a string in the config, rather than using the type/content object.

I will! I'll try to implement it in the next PR. Thank you!

@ematipico ematipico merged commit b3d8878 into feat/csp May 19, 2025
14 of 15 checks passed
@ematipico ematipico deleted the feat/csp-style-script-directives branch May 19, 2025 12:25
ematipico added a commit that referenced this pull request May 22, 2025
@ematipico @ascorbic
feat(csp): resources for script and styles directives (#13812)
8717aa4 
Co-authored-by: ascorbic <[email protected]>
ascorbic added a commit that referenced this pull request Jun 4, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot
feat: experimental CSP (#13802)
0eafe14 
* chore: build hashes of scripts (#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (#13675)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): fix CSP header, inject astro island script/style (#13687)

* feat(csp): track client scripts and CSS (#13725)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): support view transitions (#13738)

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
fix CSP header, inject astro island script/style (#13687)

* feat(csp): server islands (#13775)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): customise algorithm (#13803)

Co-authored-by: Florian Lefebvre <[email protected]>

* chore: build hashes of scripts (#13590) (#13805)

Co-authored-by: Florian Lefebvre <[email protected]>

* feat(csp): allow additional directives (#13810)

Co-authored-by: ascorbic <[email protected]>
Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): resources for script and styles directives (#13812)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): runtime APIs (#13824)

Co-authored-by: Matt Kane <[email protected]>

* feat(csp): add script-dynamic keyword support (#13834)

* update lockfile

* chore: docs and changeset (#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <[email protected]>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

---------

Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>
openscript pushed a commit to openscript/astro that referenced this pull request Sep 12, 2025
@ematipico @florian-lefebvre
@ascorbic @sarah11918 @ArmandPhilippot @openscript
feat: experimental CSP (withastro#13802)
1d9a567 
* chore: build hashes of scripts (withastro#13590)

* chore: build hashes of scripts

* chore: fix changes

* chore: fix changes

* chore: fix changes

* feat(csp): create hashes of tracked scripts and hashes (withastro#13675)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): track client scripts and CSS (withastro#13725)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): support view transitions (withastro#13738)

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
fix CSP header, inject astro island script/style (withastro#13687)

* feat(csp): server islands (withastro#13775)

Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): customise algorithm (withastro#13803)

Co-authored-by: Florian Lefebvre <[email protected]>

* chore: build hashes of scripts (withastro#13590) (withastro#13805)

Co-authored-by: Florian Lefebvre <[email protected]>

* feat(csp): allow additional directives (withastro#13810)

Co-authored-by: ascorbic <[email protected]>
Co-authored-by: florian-lefebvre <[email protected]>

* feat(csp): resources for script and styles directives (withastro#13812)

Co-authored-by: ascorbic <[email protected]>

* feat(csp): runtime APIs (withastro#13824)

Co-authored-by: Matt Kane <[email protected]>

* feat(csp): add script-dynamic keyword support (withastro#13834)

* update lockfile

* chore: docs and changeset (withastro#13870)

* chore: add changeset

* grammar

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

* Update JSDoc with examples to match docs

* Sarah's changeset edits

* Apply suggestions from code review

Thanks, @ArmandPhilippot

Co-authored-by: Armand Philippot <[email protected]>

* Fix indentation

* Update .changeset/crazy-doors-buy.md

* Apply suggestions from code review

Co-authored-by: Sarah Rainsberger <[email protected]>

---------

Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>

* Update lockfile

* dedupe deps

* Lock

* Lock

* fix: server islands in mdx

---------

Co-authored-by: florian-lefebvre <[email protected]>
Co-authored-by: ascorbic <[email protected]>
Co-authored-by: Florian Lefebvre <[email protected]>
Co-authored-by: Matt Kane <[email protected]>
Co-authored-by: Sarah Rainsberger <[email protected]>
Co-authored-by: Armand Philippot <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ascorbic ascorbic ascorbic approved these changes

Assignees

No one assigned

Labels

docs pr pkg: astro Related to the core `astro` package (scope)

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@ematipico @ascorbic