Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Install gatsby-plugin-csp #210

Merged
merged 6 commits into from Nov 11, 2019
Merged
Changes from 1 commit
Commits
File filter...
Filter file types
Jump to…
Jump to file or symbol
Failed to load files and symbols.

Always

Just for now

Add workaround to copy CSP in Netlify headers

  • Loading branch information
browniebroke committed Nov 11, 2019
commit f27c05c84b0f4f2785aca0f2b8ef73efddb39a14
@@ -0,0 +1,83 @@
#!/usr/bin/env node

const fs = require('fs')
const path = require('path')
const htmlparser = require('htmlparser2')
const replaceInFile = require('replace-in-file')

const TARGET_FOLDER = path.join(__dirname, 'public')

const INPUT_FILE = path.join(TARGET_FOLDER, 'index.html')
const OUTPUT_FILE = path.join(TARGET_FOLDER, '_headers')
const TOKEN_TO_REPLACE = '__REPLACE_ME__'

console.log('Copying the CSP for Netlify headers')

const cspContent = getCspContentFrom(INPUT_FILE)

updateNetlifyHeaderFile(cspContent, OUTPUT_FILE)

function getCspContentFrom(inputFile) {
console.log(`Getting the CSP content from ${inputFile}`)
try {
const fileContents = fs.readFileSync(inputFile, { encoding: 'utf-8' })

let found = false
let retVal = ''

const parser = new htmlparser.Parser(
{
onopentag: (name, attributes) => {
if (name === 'meta') {
if (
attributes['http-equiv'] &&
'Content-Security-Policy' === attributes['http-equiv']
) {
console.log('Found the CSP content:', attributes['content'])
found = true
retVal = attributes['content']
}
}
},
},
{ decodeEntities: true }
)

parser.write(fileContents)

if (found === false) {
throw new Error(`Could not find the CSP`)
}

return retVal
} catch (err) {
console.error(
'Could not retrieve the CSP content. Did you build first? Is the gatsby-config.js still correct?'
)
throw err
}
}

function updateNetlifyHeaderFile(cspText, outputFile) {
console.log(`Updating the CSP in the output file [${outputFile}]`)
const replacementOptions = {
files: outputFile,
from: new RegExp(TOKEN_TO_REPLACE, 'g'),
to: cspText,
}

try {
console.log(`Modifying Netlify's header file`)
const changes = replaceInFile.sync(replacementOptions)
if (changes && changes.length && changes.length > 0) {
console.log(`Modified Netlify's headers file successfully`)
} else {
throw new Error(
`Failed to find the expected token to replace: ${TOKEN_TO_REPLACE}`
)
}
} catch (error) {
console.error(`Failed to modify Netlify's header file`)
throw error
}
}
@@ -88,6 +88,18 @@ module.exports = {
pathToConfigModule: `src/utils/typography`,
},
},
`gatsby-plugin-netlify`,
{
resolve: `gatsby-plugin-netlify`,
options: {
headers: {
'/*': [
// The CSP is generated by gatsby-plugin-csp and added to the _headers file in public/ before publish.
// That is handled by the build script which executes csp-util.js, which looks for the token below.
'Content-Security-Policy: __REPLACE_ME__',
],
},
mergeSecurityHeaders: true, // boolean to turn off the default security headers
},
},
],
}
@@ -1,7 +1,7 @@
[build]
base = ""
publish = "public"
command = "gatsby build"
command = "yarn build"
environment = { GATSBY_CPU_COUNT = "1" }

# A redirect rule with all the supported properties
@@ -40,18 +40,20 @@
"gatsby-source-filesystem": "2.1.35",
"gatsby-transformer-remark": "2.6.32",
"gatsby-transformer-sharp": "2.3.2",
"htmlparser2": "^4.0.0",
"prismjs": "1.17.1",
"react": "16.11.0",
"react-dom": "16.11.0",
"react-helmet": "5.2.1",
"react-typography": "0.16.19",
"replace-in-file": "^4.2.0",
"slugify": "1.3.6",
"styled-components": "4.4.1",
"typography": "0.16.19",
"typography-theme-funston": "0.16.19"
},
"scripts": {
"build": "gatsby build",
"build": "gatsby build && node ./csp-util.js",
"develop": "gatsby develop",
"lint": "eslint --ext .js,.jsx --ignore-pattern public .",
"test": "prettier --check \"**/*.+(js|jsx|json|css|scss)\""
100 yarn.lock
@@ -2901,6 +2901,15 @@ cliui@^4.0.0:
strip-ansi "^4.0.0"
wrap-ansi "^2.0.0"

cliui@^5.0.0:
version "5.0.0"
resolved "https://registry.yarnpkg.com/cliui/-/cliui-5.0.0.tgz#deefcfdb2e800784aa34f46fa08e06851c7bbbc5"
integrity sha512-PYeGSEmmHM6zvoef2w8TPzlrnNpXIjTipYK780YswmIP9vjxmd6Y2a3CB2Ks6/AU8NHjZugXvo8w3oWM2qnwXA==
dependencies:
string-width "^3.1.0"
strip-ansi "^5.2.0"
wrap-ansi "^5.1.0"

clone-response@1.0.2:
version "1.0.2"
resolved "https://registry.yarnpkg.com/clone-response/-/clone-response-1.0.2.tgz#d1dc973920314df67fbeb94223b4ee350239e96b"
@@ -3883,6 +3892,14 @@ dom-serializer@0, dom-serializer@~0.1.1:
domelementtype "^1.3.0"
entities "^1.1.1"

dom-serializer@^0.2.1:
version "0.2.2"
resolved "https://registry.yarnpkg.com/dom-serializer/-/dom-serializer-0.2.2.tgz#1afb81f533717175d478655debc5e332d9f9bb51"
integrity sha512-2/xPb3ORsQ42nHYiSunXkDjPLBaEj/xTwUO4B7XCZQTRk7EBtTOPaygh10YAAh2OI1Qrp6NWfpAhzswj0ydt9g==
dependencies:
domelementtype "^2.0.1"
entities "^2.0.0"

dom-walk@^0.1.0:
version "0.1.1"
resolved "https://registry.yarnpkg.com/dom-walk/-/dom-walk-0.1.1.tgz#672226dc74c8f799ad35307df936aba11acd6018"
@@ -3895,12 +3912,24 @@ domelementtype@1, domelementtype@^1.3.0, domelementtype@^1.3.1:
version "1.3.1"
resolved "https://registry.yarnpkg.com/domelementtype/-/domelementtype-1.3.1.tgz#d048c44b37b0d10a7f2a3d5fee3f4333d790481f"

domelementtype@^2.0.1:
version "2.0.1"
resolved "https://registry.yarnpkg.com/domelementtype/-/domelementtype-2.0.1.tgz#1f8bdfe91f5a78063274e803b4bdcedf6e94f94d"
integrity sha512-5HOHUDsYZWV8FGWN0Njbr/Rn7f/eWSQi1v7+HsUVwXgn8nWWlL64zKDkS0n8ZmQ3mlWOMuXOnR+7Nx/5tMO5AQ==

domhandler@^2.3.0:
version "2.4.2"
resolved "https://registry.yarnpkg.com/domhandler/-/domhandler-2.4.2.tgz#8805097e933d65e85546f726d60f5eb88b44f803"
dependencies:
domelementtype "1"

domhandler@^3.0.0:
version "3.0.0"
resolved "https://registry.yarnpkg.com/domhandler/-/domhandler-3.0.0.tgz#51cd13efca31da95bbb0c5bee3a48300e333b3e9"
integrity sha512-eKLdI5v9m67kbXQbJSNn1zjh0SDzvzWVWtX+qEI3eMjZw8daH9k8rlj1FZY9memPwjiskQFbe7vHVVJIAqoEhw==
dependencies:
domelementtype "^2.0.1"

domutils@1.5.1:
version "1.5.1"
resolved "https://registry.yarnpkg.com/domutils/-/domutils-1.5.1.tgz#dcd8488a26f563d61079e48c9f7b7e32373682cf"
@@ -3915,6 +3944,15 @@ domutils@^1.5.1, domutils@^1.7.0:
dom-serializer "0"
domelementtype "1"

domutils@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/domutils/-/domutils-2.0.0.tgz#15b8278e37bfa8468d157478c58c367718133c08"
integrity sha512-n5SelJ1axbO636c2yUtOGia/IcJtVtlhQbFiVDBZHKV5ReJO1ViX7sFEemtuyoAnBxk5meNSYgA8V4s0271efg==
dependencies:
dom-serializer "^0.2.1"
domelementtype "^2.0.1"
domhandler "^3.0.0"

dot-prop@^4.1.0, dot-prop@^4.1.1:
version "4.2.0"
resolved "https://registry.yarnpkg.com/dot-prop/-/dot-prop-4.2.0.tgz#1f19e0c2e1aa0e32797c49799f2837ac6af69c57"
@@ -4099,6 +4137,11 @@ entities@^1.1.1, entities@~1.1.1:
version "1.1.2"
resolved "https://registry.yarnpkg.com/entities/-/entities-1.1.2.tgz#bdfa735299664dfafd34529ed4f8522a275fea56"

entities@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/entities/-/entities-2.0.0.tgz#68d6084cab1b079767540d80e56a39b423e4abf4"
integrity sha512-D9f7V0JSRwIxlRI2mjMqufDrRDnx8p+eEOz7aUM9SuvF8gsBzra0/6tbjl1m8eQHrZlYj6PxqE00hZ1SAIKPLw==

envinfo@^5.12.1:
version "5.12.1"
resolved "https://registry.yarnpkg.com/envinfo/-/envinfo-5.12.1.tgz#83068c33e0972eb657d6bc69a6df30badefb46ef"
@@ -5503,6 +5546,11 @@ get-caller-file@^1.0.1:
version "1.0.3"
resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-1.0.3.tgz#f978fa4c90d1dfe7ff2d6beda2a515e713bdcf4a"

get-caller-file@^2.0.1:
version "2.0.5"
resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e"
integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg==

get-own-enumerable-property-symbols@^3.0.0:
version "3.0.0"
resolved "https://registry.yarnpkg.com/get-own-enumerable-property-symbols/-/get-own-enumerable-property-symbols-3.0.0.tgz#b877b49a5c16aefac3655f2ed2ea5b684df8d203"
@@ -6099,6 +6147,16 @@ htmlparser2@^3.10.0, htmlparser2@^3.3.0, htmlparser2@^3.9.1:
inherits "^2.0.1"
readable-stream "^3.1.1"

htmlparser2@^4.0.0:
version "4.0.0"
resolved "https://registry.yarnpkg.com/htmlparser2/-/htmlparser2-4.0.0.tgz#6034658db65b7713a572a9ebf79f650832dceec8"
integrity sha512-cChwXn5Vam57fyXajDtPXL1wTYc8JtLbr2TN76FYu05itVVVealxLowe2B3IEznJG4p9HAYn/0tJaRlGuEglFQ==
dependencies:
domelementtype "^2.0.1"
domhandler "^3.0.0"
domutils "^2.0.0"
entities "^2.0.0"

http-cache-semantics@3.8.1:
version "3.8.1"
resolved "https://registry.yarnpkg.com/http-cache-semantics/-/http-cache-semantics-3.8.1.tgz#39b0e16add9b605bf0a9ef3d9daaf4843b4cacd2"
@@ -9811,6 +9869,15 @@ replace-ext@1.0.0, replace-ext@^1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/replace-ext/-/replace-ext-1.0.0.tgz#de63128373fcbf7c3ccfa4de5a480c45a67958eb"

replace-in-file@^4.2.0:
version "4.2.0"
resolved "https://registry.yarnpkg.com/replace-in-file/-/replace-in-file-4.2.0.tgz#be779f4f61a8ee1ab9f917998bd36441673680fe"
integrity sha512-9PGYDbU8iQF3W5a0Ariaf4KzYjsZSkonCYiZylwMiYOu0w5Bg9IuT4DqNnibA4zGNVxH//F7Hxh1P25TofAHGw==
dependencies:
chalk "^2.4.2"
glob "^7.1.4"
yargs "^13.3.0"

request@^2.83.0:
version "2.88.0"
resolved "https://registry.yarnpkg.com/request/-/request-2.88.0.tgz#9c2fca4f7d35b592efe57c7f0a55e81052124fef"
@@ -9844,6 +9911,11 @@ require-main-filename@^1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/require-main-filename/-/require-main-filename-1.0.1.tgz#97f717b69d48784f5f526a6c5aa8ffdda055a4d1"

require-main-filename@^2.0.0:
version "2.0.0"
resolved "https://registry.yarnpkg.com/require-main-filename/-/require-main-filename-2.0.0.tgz#d0b329ecc7cc0f61649f62215be69af54aa8989b"
integrity sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg==

requires-port@^1.0.0:
version "1.0.0"
resolved "https://registry.yarnpkg.com/requires-port/-/requires-port-1.0.0.tgz#925d2601d39ac485e091cf0da5c6e694dc3dcaff"
@@ -10726,7 +10798,7 @@ string-width@^1.0.1:
is-fullwidth-code-point "^2.0.0"
strip-ansi "^4.0.0"

string-width@^3.0.0:
string-width@^3.0.0, string-width@^3.1.0:
version "3.1.0"
resolved "https://registry.yarnpkg.com/string-width/-/string-width-3.1.0.tgz#22767be21b62af1081574306f69ac51b62203961"
dependencies:
@@ -12049,7 +12121,7 @@ wrap-ansi@^2.0.0:
string-width "^1.0.1"
strip-ansi "^3.0.1"

wrap-ansi@^5.0.0:
wrap-ansi@^5.0.0, wrap-ansi@^5.1.0:
version "5.1.0"
resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-5.1.0.tgz#1fd1f67235d5b6d0fee781056001bfb694c03b09"
dependencies:
@@ -12187,6 +12259,14 @@ yargs-parser@^11.1.1:
camelcase "^5.0.0"
decamelize "^1.2.0"

yargs-parser@^13.1.1:
version "13.1.1"
resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-13.1.1.tgz#d26058532aa06d365fe091f6a1fc06b2f7e5eca0"
integrity sha512-oVAVsHz6uFrg3XQheFII8ESO2ssAf9luWuAd6Wexsu4F3OtIW0o8IribPXYrD4WC24LWtPrJlGy87y5udK+dxQ==
dependencies:
camelcase "^5.0.0"
decamelize "^1.2.0"

yargs-parser@^7.0.0:
version "7.0.0"
resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-7.0.0.tgz#8d0ac42f16ea55debd332caf4c4038b3e3f5dfd9"
@@ -12210,6 +12290,22 @@ yargs@12.0.5, yargs@^12.0.5:
y18n "^3.2.1 || ^4.0.0"
yargs-parser "^11.1.1"

yargs@^13.3.0:
version "13.3.0"
resolved "https://registry.yarnpkg.com/yargs/-/yargs-13.3.0.tgz#4c657a55e07e5f2cf947f8a366567c04a0dedc83"
integrity sha512-2eehun/8ALW8TLoIl7MVaRUrg+yCnenu8B4kBlRxj3GJGDKU1Og7sMXPNm1BYyM1DOJmTZ4YeN/Nwxv+8XJsUA==
dependencies:
cliui "^5.0.0"
find-up "^3.0.0"
get-caller-file "^2.0.1"
require-directory "^2.1.1"
require-main-filename "^2.0.0"
set-blocking "^2.0.0"
string-width "^3.0.0"
which-module "^2.0.0"
y18n "^4.0.0"
yargs-parser "^13.1.1"

yargs@^9.0.0:
version "9.0.1"
resolved "https://registry.yarnpkg.com/yargs/-/yargs-9.0.1.tgz#52acc23feecac34042078ee78c0c007f5085db4c"
ProTip! Use n and p to navigate between commits in a pull request.
You can’t perform that action at this time.