makestatic-csp-sha v1.0.4

Content Security Policy SHA

Generate content security policy meta elements and SHA checksums

• Install
• API
  • ContentSecurityPolicySha
    • See Also
    • ContentSecurityPolicySha
      • Options
    • .before
    • .sources
    • .after
• License

Install

yarn add makestatic-csp-sha

API

ContentSecurityPolicySha

Inject file specific content security policy meta elements and generate SHA checksums for inline elements.

For each HTML file inspect the plugin rules and inject a meta element for each matched rule. When the styles or scripts options are used it will also generate content security policies using the sha algorithm.

Requires that the parse-html and parse-csp plugins have been enabled for the parse phase as it operates on the HTML and CSP abstract syntax trees.

Enable this plugin for the emit phase.

This plugin is functionally equivalent to the primary csp plugin which can be enabled during the transform phase with the following differences:

• It generates sha checksums not nonce values
• It must be configured for the emit phase (not transform)

The reason for this is that the checksums must use the final text content for the inline scripts and styles in order for browsers to correctly enforce the CSP, if this plugin was configured for the transform phase inline styles and scripts might be altered after checksum generation during the optimize phase.

You should not combine the csp and csp-sha plugins - use one or the other.

See Also

• Parse HTML
• Parse CSP
• Content Security Policy
• CSP Reference & Examples

ContentSecurityPolicySha

new ContentSecurityPolicySha(context, options)

Create a ContentSecurityPolicySha plugin.

Use this plugin during the emit phase, you should enable the parse-csp and parse-html plugins for the parse phase.

This plugin uses a default content security policy parsed from csp.txt,

When the watch option is set this plugin will automatically include a connect-src policy with the ws://localhost:* and http://localhost:* values so that browsersync will work as expected.

A rule consists of a test regular expression pattern and the policy to merge with the parsed content security policy abstract syntax tree.

{
  rules: [
    {
      test: /news\//,
      file: 'news-csp.txt',
      policy: {
        'default-src': ['self'],
        'frame-src': ['none']
      }
    }
  ]
}

Use the file rule field when you want to use a default policy from an alternative content security policy file.

If no test pattern is specified for a rule it will apply to all files this plugin matches.

If no rules are given this plugin will operate on all matched files using a default rule object.

Use the styles and scripts options to generate content security policies for inline elements using a sha algorithm.

You can use the algorithm option to change the SHA checksum algorithm.

If an unknown algorithm is passed the default will be used.

• context Object the processing context.
• options Object plugin options.

Options

• rules Array list of file match rules.
• algorithm String=sha512 checksum algorithm.
• styles Boolean generate inline style policies.
• scripts Boolean generate inline script policies.

.before

ContentSecurityPolicySha.prototype.before(context, options)

Configure the list of matched files.

• context Object the processing context.
• options Object plugin options.

.sources

ContentSecurityPolicySha.prototype.sources(file, context, options)

Find the first matching rule for a file.

• file File the current file.
• context Object the processing context.
• options Object plugin options.

.after

ContentSecurityPolicySha.prototype.after(context, options)

Rewrite file content.

• context Object the processing context.
• options Object plugin options.

License

MIT

Created by mkdoc on March 12, 2017