chore: build hashes of scripts (#13590) by ematipico · Pull Request #13805 · withastro/astro

ematipico · 2025-05-14T13:43:12Z

Changes

Depends on #13803

This PR adds support for scriptHashes and styleHashes: https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md?rgh-link-date=2025-05-14T11%3A19%3A53Z#configuration-apis

This PR adds a layer of validation of the inputs provided by the users. It checks if the hashes start with a certain string.

Testing

Added new tests

Docs

changeset-bot · 2025-05-14T13:43:17Z

⚠️ No Changeset found

Latest commit: ad5fa1e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

florian-lefebvre · 2025-05-15T08:39:21Z

There are still conflicts so it doesn't have all the changes from the last PR

ematipico · 2025-05-15T09:23:52Z

Conflicts resolved @florian-lefebvre, thank you for your patience

florian-lefebvre · 2025-05-15T09:58:38Z

 		csp = {
-			clientScriptHashes: [],
-			clientStyleHashes: [],
+			clientScriptHashes: getScriptHashes(settings.config),


Semi related to this PR: why aren't you calling trackStyleHashes/trackScriptHashes?

They are meant to be called during the build. They accept BuildInternals, which is a type that we populate during the build. The development server doesn't have such things.

florian-lefebvre · 2025-05-15T13:28:22Z

@ematipico done! I also added type tests

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

@ArmandPhilippot

* chore: build hashes of scripts (#13590) * chore: build hashes of scripts * chore: fix changes * chore: fix changes * chore: fix changes * feat(csp): create hashes of tracked scripts and hashes (#13675) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): fix CSP header, inject astro island script/style (#13687) * feat(csp): track client scripts and CSS (#13725) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): support view transitions (#13738) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> fix CSP header, inject astro island script/style (#13687) * feat(csp): server islands (#13775) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): customise algorithm (#13803) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * chore: build hashes of scripts (#13590) (#13805) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * feat(csp): allow additional directives (#13810) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): resources for script and styles directives (#13812) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): runtime APIs (#13824) Co-authored-by: Matt Kane <m@mk.gg> * feat(csp): add script-dynamic keyword support (#13834) * update lockfile * chore: docs and changeset (#13870) * chore: add changeset * grammar * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> * Update JSDoc with examples to match docs * Sarah's changeset edits * Apply suggestions from code review Thanks, @ArmandPhilippot Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Fix indentation * Update .changeset/crazy-doors-buy.md * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> --------- Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Update lockfile * dedupe deps * Lock * Lock * fix: server islands in mdx --------- Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Armand Philippot <git@armand.philippot.eu>

@ArmandPhilippot

* chore: build hashes of scripts (withastro#13590) * chore: build hashes of scripts * chore: fix changes * chore: fix changes * chore: fix changes * feat(csp): create hashes of tracked scripts and hashes (withastro#13675) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): fix CSP header, inject astro island script/style (withastro#13687) * feat(csp): track client scripts and CSS (withastro#13725) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): support view transitions (withastro#13738) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> fix CSP header, inject astro island script/style (withastro#13687) * feat(csp): server islands (withastro#13775) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): customise algorithm (withastro#13803) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * chore: build hashes of scripts (withastro#13590) (withastro#13805) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * feat(csp): allow additional directives (withastro#13810) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): resources for script and styles directives (withastro#13812) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): runtime APIs (withastro#13824) Co-authored-by: Matt Kane <m@mk.gg> * feat(csp): add script-dynamic keyword support (withastro#13834) * update lockfile * chore: docs and changeset (withastro#13870) * chore: add changeset * grammar * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> * Update JSDoc with examples to match docs * Sarah's changeset edits * Apply suggestions from code review Thanks, @ArmandPhilippot Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Fix indentation * Update .changeset/crazy-doors-buy.md * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> --------- Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Update lockfile * dedupe deps * Lock * Lock * fix: server islands in mdx --------- Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Armand Philippot <git@armand.philippot.eu>

github-actions Bot added pkg: astro Related to the core `astro` package (scope) docs pr labels May 14, 2025

ematipico force-pushed the feat/csp-external-hashes branch from d7bad7e to f1c0bfc Compare May 14, 2025 14:17

Base automatically changed from feat/csp-configuration to feat/csp May 15, 2025 09:13

feat(csp): pass external hashes

5850fe9

ematipico force-pushed the feat/csp-external-hashes branch from f1c0bfc to 5850fe9 Compare May 15, 2025 09:16

florian-lefebvre reviewed May 15, 2025

View reviewed changes

apply feedback

ee3fd24

ematipico requested a review from florian-lefebvre May 15, 2025 10:28

florian-lefebvre approved these changes May 15, 2025

View reviewed changes

Comment thread packages/astro/src/core/csp/common.ts Outdated

apply feedback

53f327a

florian-lefebvre reviewed May 15, 2025

View reviewed changes

Comment thread packages/astro/src/core/csp/config.ts Outdated

Comment thread packages/astro/src/types/public/config.ts Outdated

ematipico and others added 4 commits May 15, 2025 13:50

fix test

3d8c8b3

ops

6eba6ab

fix: types

ab20b18

feat: type tests

b37eb7b

remove log

ad5fa1e

ematipico merged commit 3884e4f into feat/csp May 15, 2025
5 checks passed

ematipico deleted the feat/csp-external-hashes branch May 15, 2025 13:36

ematipico added a commit that referenced this pull request May 22, 2025

chore: build hashes of scripts (#13590) (#13805)

8b62e71

Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: build hashes of scripts (#13590)#13805

chore: build hashes of scripts (#13590)#13805
ematipico merged 8 commits into
feat/cspfrom
feat/csp-external-hashes

ematipico commented May 14, 2025

Uh oh!

changeset-bot Bot commented May 14, 2025 •

edited

Loading

Uh oh!

florian-lefebvre commented May 15, 2025

Uh oh!

ematipico commented May 15, 2025

Uh oh!

florian-lefebvre May 15, 2025

Uh oh!

ematipico May 15, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

florian-lefebvre commented May 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ematipico commented May 14, 2025

Changes

Testing

Docs

Uh oh!

changeset-bot Bot commented May 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

florian-lefebvre commented May 15, 2025

Uh oh!

ematipico commented May 15, 2025

Uh oh!

florian-lefebvre May 15, 2025

Choose a reason for hiding this comment

Uh oh!

ematipico May 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

florian-lefebvre commented May 15, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented May 14, 2025 •

edited

Loading

ematipico May 15, 2025 •

edited

Loading