Skip to content

fix: quote trusted-types-eval and the other missing CSP keywords #17490

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lprnmns wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix: quote trusted-types-eval and the other missing CSP keywords #17490

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions .changeset/quote-csp-keywords.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
---
'@sveltejs/kit': patch
---

fix: quote the `trusted-types-eval`, `unsafe-allow-redirects`, `unsafe-webtransport-hashes` and `allow-duplicates` CSP keywords
4 changes: 2 additions & 2 deletions packages/kit/src/runtime/server/cookie.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,7 +37,7 @@ const cookies_setup = ({ href, headers } = {}) => {
return result;
};

describe.skipIf(!process.env.DEV)('cookies in dev', () => {
describe.skipIf(!process.env.KIT_TEST_DEV)('cookies in dev', () => {
beforeAll(() => {
vi.stubGlobal('__SVELTEKIT_DEV__', true);
});
Expand Down Expand Up @@ -96,7 +96,7 @@ describe.skipIf(!process.env.DEV)('cookies in dev', () => {
});
});

describe.skipIf(!!process.env.DEV)('cookies in prod', () => {
describe.skipIf(!!process.env.KIT_TEST_DEV)('cookies in prod', () => {
beforeAll(() => {
vi.stubGlobal('__SVELTEKIT_DEV__', false);
});
Expand Down
4 changes: 4 additions & 0 deletions packages/kit/src/runtime/server/page/csp.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,10 @@ const quoted = new Set([
'unsafe-eval',
'unsafe-hashes',
'unsafe-inline',
'unsafe-allow-redirects',
'unsafe-webtransport-hashes',
'trusted-types-eval',
'allow-duplicates',
'none',
'strict-dynamic',
'report-sample',
Expand Down
24 changes: 22 additions & 2 deletions packages/kit/src/runtime/server/page/csp.spec.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ import process from 'node:process';
import { assert, expect, test, describe, beforeAll } from 'vitest';
import { Csp } from './csp.js';

describe.skipIf(!process.env.DEV)('CSPs in dev', () => {
describe.skipIf(!process.env.KIT_TEST_DEV)('CSPs in dev', () => {
beforeAll(() => {
// @ts-expect-error
globalThis.__SVELTEKIT_DEV__ = true;
Expand Down Expand Up @@ -69,7 +69,7 @@ describe.skipIf(!process.env.DEV)('CSPs in dev', () => {
});
});

describe.skipIf(!!process.env.DEV)('CSPs in prod', () => {
describe.skipIf(!!process.env.KIT_TEST_DEV)('CSPs in prod', () => {
beforeAll(() => {
// @ts-expect-error
globalThis.__SVELTEKIT_DEV__ = false;
Expand Down Expand Up @@ -602,4 +602,24 @@ describe.skipIf(!!process.env.DEV)('CSPs in prod', () => {
"script-src 'self' 'report-sha256' 'report-sha384' 'report-sha512'"
);
});

test('quotes the other keyword sources', () => {
const csp = new Csp(
{
mode: 'nonce',
directives: {
'script-src': ['self', 'trusted-types-eval', 'unsafe-allow-redirects'],
'connect-src': ['self', 'unsafe-webtransport-hashes'],
'trusted-types': ['my-policy', 'allow-duplicates']
},
reportOnly: {}
},
{ prerender: false }
);

assert.equal(
csp.csp_provider.get_header(),
"script-src 'self' 'trusted-types-eval' 'unsafe-allow-redirects'; connect-src 'self' 'unsafe-webtransport-hashes'; trusted-types my-policy 'allow-duplicates'"
);
});
});
3 changes: 2 additions & 1 deletion packages/kit/vitest.kit.config.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,8 +53,9 @@ export default /** @satisfies {import('vitest/config').ViteUserConfig} */ ({
name: 'kit-server-build',
setupFiles,
environment: 'node',
// Vitest sets `process.env.DEV` itself, so the dev-only suites use their own flag
env: {
DEV: 'true'
KIT_TEST_DEV: 'true'
},
include: ['src/runtime/server/page/csp.spec.js', 'src/runtime/server/cookie.spec.js'],
exclude: [...exclude, 'src/**/*.svelte.spec.js']
Expand Down
Loading