feat(csp): customise algorithm by ematipico · Pull Request #13803 · withastro/astro

ematipico · 2025-05-14T11:19:53Z

Changes

This PR implements the csp.algorithm configuration from the RFC: https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md#configuration-apis

The generateDigest function now accepts an algorithm parameter, which is passed down during the rendering phase.

I removed the cspMiddleware. I thought I was going to use it, but it turn out it isn't needed for the time being

Testing

I added two new tests

Docs

changeset-bot · 2025-05-14T11:19:58Z

⚠️ No Changeset found

Latest commit: 0db9a40

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

florian-lefebvre

LGTM!

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

@ArmandPhilippot

* chore: build hashes of scripts (#13590) * chore: build hashes of scripts * chore: fix changes * chore: fix changes * chore: fix changes * feat(csp): create hashes of tracked scripts and hashes (#13675) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): fix CSP header, inject astro island script/style (#13687) * feat(csp): track client scripts and CSS (#13725) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): support view transitions (#13738) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> fix CSP header, inject astro island script/style (#13687) * feat(csp): server islands (#13775) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): customise algorithm (#13803) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * chore: build hashes of scripts (#13590) (#13805) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * feat(csp): allow additional directives (#13810) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): resources for script and styles directives (#13812) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): runtime APIs (#13824) Co-authored-by: Matt Kane <m@mk.gg> * feat(csp): add script-dynamic keyword support (#13834) * update lockfile * chore: docs and changeset (#13870) * chore: add changeset * grammar * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> * Update JSDoc with examples to match docs * Sarah's changeset edits * Apply suggestions from code review Thanks, @ArmandPhilippot Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Fix indentation * Update .changeset/crazy-doors-buy.md * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> --------- Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Update lockfile * dedupe deps * Lock * Lock * fix: server islands in mdx --------- Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Armand Philippot <git@armand.philippot.eu>

@ArmandPhilippot

* chore: build hashes of scripts (withastro#13590) * chore: build hashes of scripts * chore: fix changes * chore: fix changes * chore: fix changes * feat(csp): create hashes of tracked scripts and hashes (withastro#13675) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): fix CSP header, inject astro island script/style (withastro#13687) * feat(csp): track client scripts and CSS (withastro#13725) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): support view transitions (withastro#13738) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> fix CSP header, inject astro island script/style (withastro#13687) * feat(csp): server islands (withastro#13775) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): customise algorithm (withastro#13803) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * chore: build hashes of scripts (withastro#13590) (withastro#13805) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * feat(csp): allow additional directives (withastro#13810) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): resources for script and styles directives (withastro#13812) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): runtime APIs (withastro#13824) Co-authored-by: Matt Kane <m@mk.gg> * feat(csp): add script-dynamic keyword support (withastro#13834) * update lockfile * chore: docs and changeset (withastro#13870) * chore: add changeset * grammar * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> * Update JSDoc with examples to match docs * Sarah's changeset edits * Apply suggestions from code review Thanks, @ArmandPhilippot Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Fix indentation * Update .changeset/crazy-doors-buy.md * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> --------- Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Update lockfile * dedupe deps * Lock * Lock * fix: server islands in mdx --------- Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Armand Philippot <git@armand.philippot.eu>

feat(csp): custom algorithm

39fb70a

github-actions Bot added pkg: astro Related to the core `astro` package (scope) docs pr labels May 14, 2025

ematipico changed the title ~~chore: build hashes of scripts (#13590)~~ feat(csp): customise algorithm May 14, 2025

ematipico mentioned this pull request May 14, 2025

chore: build hashes of scripts (#13590) #13805

Merged

florian-lefebvre reviewed May 15, 2025

View reviewed changes

ematipico and others added 3 commits May 15, 2025 08:29

Update packages/astro/src/core/build/generate.ts

0aae798

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

Update packages/astro/src/core/csp/common.ts

c141545

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

feedback

dde5048

ematipico requested a review from florian-lefebvre May 15, 2025 07:35

florian-lefebvre reviewed May 15, 2025

View reviewed changes

ematipico and others added 4 commits May 15, 2025 09:14

Update packages/astro/src/core/encryption.ts

a169691

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

Update packages/astro/src/core/encryption.ts

2bccd37

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

feedback

fb93fbf

feedback

d8a6663

ematipico requested a review from florian-lefebvre May 15, 2025 08:16

ematipico and others added 2 commits May 15, 2025 09:19

address more feedback

0e2e524

Update packages/astro/src/core/csp/common.ts

0db9a40

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

florian-lefebvre approved these changes May 15, 2025

View reviewed changes

ematipico merged commit 3b00f85 into feat/csp May 15, 2025
15 checks passed

ematipico deleted the feat/csp-configuration branch May 15, 2025 09:13

ematipico added a commit that referenced this pull request May 22, 2025

feat(csp): customise algorithm (#13803)

ea6d30d

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(csp): customise algorithm#13803

feat(csp): customise algorithm#13803
ematipico merged 10 commits into
feat/cspfrom
feat/csp-configuration

ematipico commented May 14, 2025

Uh oh!

changeset-bot Bot commented May 14, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

florian-lefebvre left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ematipico commented May 14, 2025

Changes

Testing

Docs

Uh oh!

changeset-bot Bot commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

florian-lefebvre left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented May 14, 2025 •

edited

Loading