feat(csp): resources for script and styles directives by ematipico · Pull Request #13812 · withastro/astro

ematipico · 2025-05-16T10:42:09Z

Changes

This PR implements the following chapter of the RFC: https://github.com/withastro/roadmap/blob/feat/rfc-csp/proposals/0055-csp.md#customize-the-script-src-and-style-src-directives

Changes:

The schema and validation of the hashes is now done via z.custom, which provides runtime validation and a better type check
I did some internal renaming
I refactored the code in order match the RFC. In the RFC I changed the structure of the configuration. From having styleHashes and styleResources, we now have styleDirective.hash and styleDirective.resources

Testing

I updated the validation test, since now we don't raise a custom message anymore.
Added new integration tests and updated the current ones.

Docs

changeset-bot · 2025-05-16T10:42:14Z

⚠️ No Changeset found

Latest commit: 606fc05

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

ascorbic

Looks good. It might be nice to adopt the same approach for typing and validating directives as a string in the config, rather than using the type/content object.

ascorbic · 2025-05-19T10:51:09Z

+
+	let scriptResources = "'self'";
+	if (result.scriptResources.length > 0) {
+		scriptResources = result.scriptResources.map((r) => `'${r}'`).join(' ');


Are there scenarios where this could need escaping?

Not that I'm aware of. URLs don't have apostrophes, and the other resources are well-known

ematipico · 2025-05-19T12:24:52Z

Looks good. It might be nice to adopt the same approach for typing and validating directives as a string in the config, rather than using the type/content object.

I will! I'll try to implement it in the next PR. Thank you!

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

@ArmandPhilippot

* chore: build hashes of scripts (#13590) * chore: build hashes of scripts * chore: fix changes * chore: fix changes * chore: fix changes * feat(csp): create hashes of tracked scripts and hashes (#13675) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): fix CSP header, inject astro island script/style (#13687) * feat(csp): track client scripts and CSS (#13725) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): support view transitions (#13738) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> fix CSP header, inject astro island script/style (#13687) * feat(csp): server islands (#13775) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): customise algorithm (#13803) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * chore: build hashes of scripts (#13590) (#13805) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * feat(csp): allow additional directives (#13810) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): resources for script and styles directives (#13812) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): runtime APIs (#13824) Co-authored-by: Matt Kane <m@mk.gg> * feat(csp): add script-dynamic keyword support (#13834) * update lockfile * chore: docs and changeset (#13870) * chore: add changeset * grammar * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> * Update JSDoc with examples to match docs * Sarah's changeset edits * Apply suggestions from code review Thanks, @ArmandPhilippot Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Fix indentation * Update .changeset/crazy-doors-buy.md * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> --------- Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Update lockfile * dedupe deps * Lock * Lock * fix: server islands in mdx --------- Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Armand Philippot <git@armand.philippot.eu>

@ArmandPhilippot

* chore: build hashes of scripts (withastro#13590) * chore: build hashes of scripts * chore: fix changes * chore: fix changes * chore: fix changes * feat(csp): create hashes of tracked scripts and hashes (withastro#13675) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): fix CSP header, inject astro island script/style (withastro#13687) * feat(csp): track client scripts and CSS (withastro#13725) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): support view transitions (withastro#13738) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> fix CSP header, inject astro island script/style (withastro#13687) * feat(csp): server islands (withastro#13775) Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): customise algorithm (withastro#13803) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * chore: build hashes of scripts (withastro#13590) (withastro#13805) Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> * feat(csp): allow additional directives (withastro#13810) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> * feat(csp): resources for script and styles directives (withastro#13812) Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> * feat(csp): runtime APIs (withastro#13824) Co-authored-by: Matt Kane <m@mk.gg> * feat(csp): add script-dynamic keyword support (withastro#13834) * update lockfile * chore: docs and changeset (withastro#13870) * chore: add changeset * grammar * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> * Update JSDoc with examples to match docs * Sarah's changeset edits * Apply suggestions from code review Thanks, @ArmandPhilippot Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Fix indentation * Update .changeset/crazy-doors-buy.md * Apply suggestions from code review Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> --------- Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Armand Philippot <git@armand.philippot.eu> * Update lockfile * dedupe deps * Lock * Lock * fix: server islands in mdx --------- Co-authored-by: florian-lefebvre <69633530+florian-lefebvre@users.noreply.github.com> Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com> Co-authored-by: Florian Lefebvre <contact@florian-lefebvre.dev> Co-authored-by: Matt Kane <m@mk.gg> Co-authored-by: Sarah Rainsberger <5098874+sarah11918@users.noreply.github.com> Co-authored-by: Armand Philippot <git@armand.philippot.eu>

feat(csp): add custom resources

75c8485

github-actions Bot added pkg: astro Related to the core `astro` package (scope) docs pr labels May 16, 2025

ematipico added 3 commits May 16, 2025 11:52

skip

0bb6175

fix define config test

c81dd40

address feedback

57dac27

ascorbic approved these changes May 19, 2025

View reviewed changes

fix small regression

606fc05

ematipico force-pushed the feat/csp-style-script-directives branch from f12f4be to 606fc05 Compare May 19, 2025 12:03

ematipico merged commit b3d8878 into feat/csp May 19, 2025
14 of 15 checks passed

ematipico deleted the feat/csp-style-script-directives branch May 19, 2025 12:25

ematipico added a commit that referenced this pull request May 22, 2025

feat(csp): resources for script and styles directives (#13812)

8717aa4

Co-authored-by: ascorbic <213306+ascorbic@users.noreply.github.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat(csp): resources for script and styles directives#13812

feat(csp): resources for script and styles directives#13812
ematipico merged 5 commits into
feat/cspfrom
feat/csp-style-script-directives

ematipico commented May 16, 2025

Uh oh!

changeset-bot Bot commented May 16, 2025 •

edited

Loading

Uh oh!

ascorbic left a comment

Uh oh!

ascorbic May 19, 2025

Uh oh!

ematipico May 19, 2025

Uh oh!

ematipico commented May 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Uh oh!

Conversation

ematipico commented May 16, 2025

Changes

Testing

Docs

Uh oh!

changeset-bot Bot commented May 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

ascorbic left a comment

Choose a reason for hiding this comment

Uh oh!

ascorbic May 19, 2025

Choose a reason for hiding this comment

Uh oh!

ematipico May 19, 2025

Choose a reason for hiding this comment

Uh oh!

ematipico commented May 19, 2025

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

changeset-bot Bot commented May 16, 2025 •

edited

Loading