-
Notifications
You must be signed in to change notification settings - Fork 43
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: support cjs and esm both by tshy (#101)
BREAKING CHANGE: drop Node.js < 18.19.0 support part of eggjs/egg#3644 eggjs/egg#5257 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Based on the comprehensive changes, here are the updated release notes: - **New Features** - Migrated security plugin to TypeScript. - Enhanced type safety for security configurations. - Improved middleware and helper utilities. - Introduced new middleware for handling `Strict-Transport-Security`, `X-Frame-Options`, and `X-XSS-Protection` headers. - Added support for new security configurations and helper functions. - **Breaking Changes** - Renamed package from `egg-security` to `@eggjs/security`. - Dropped support for Node.js versions below 18.19.0. - Restructured module exports and configurations. - Removed several deprecated middleware and utility functions. - **Security Improvements** - Updated CSRF, XSS, and SSRF protection mechanisms. - Enhanced middleware for handling security headers. - Refined configuration options for various security features. - **Performance** - Modernized codebase with ES module syntax. - Improved type definitions and module structure. - Enhanced test suite with TypeScript support and better resource management. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
- Loading branch information
1 parent
e340840
commit a11661f
Showing
135 changed files
with
2,359 additions
and
1,385 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,5 +1,3 @@ | ||
| test/fixtures | ||
| test/benchmark | ||
| coverage | ||
| node_modules | ||
| lib/plugins/**/app/proxy | ||
| __snapshots__ |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,6 +1,6 @@ | ||
| { | ||
| "extends": [ | ||
| "eslint-config-egg", | ||
| "eslint-config-egg/typescript", | ||
| "eslint-config-egg/lib/rules/enforce-node-prefix" | ||
| ] | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,11 +1,11 @@ | ||
| node_modules | ||
| coverage | ||
| test/**/logs | ||
| _book | ||
| .DS_Store | ||
| logs/ | ||
| npm-debug.log | ||
| run/ | ||
| .vscode | ||
| node_modules/ | ||
| coverage/ | ||
| test/fixtures/**/run | ||
| .DS_Store | ||
| .tshy* | ||
| .eslintcache | ||
| dist | ||
| package-lock.json | ||
| .travis.yml | ||
| .idea | ||
| .package-lock.json |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,84 @@ | ||
| exports['test/config/config.default.test.ts should config default values keep stable 1'] = { | ||
| "security": { | ||
| "domainWhiteList": [], | ||
| "protocolWhiteList": [], | ||
| "defaultMiddleware": [ | ||
| "csrf", | ||
| "hsts", | ||
| "methodnoallow", | ||
| "noopen", | ||
| "nosniff", | ||
| "csp", | ||
| "xssProtection", | ||
| "xframe", | ||
| "dta" | ||
| ], | ||
| "csrf": { | ||
| "enable": true, | ||
| "type": "ctoken", | ||
| "ignoreJSON": false, | ||
| "cookieName": "csrfToken", | ||
| "sessionName": "csrfToken", | ||
| "headerName": "x-csrf-token", | ||
| "bodyName": "_csrf", | ||
| "queryName": "_csrf", | ||
| "rotateWhenInvalid": false, | ||
| "useSession": false, | ||
| "supportedRequests": [ | ||
| { | ||
| "path": {}, | ||
| "methods": [ | ||
| "POST", | ||
| "PATCH", | ||
| "DELETE", | ||
| "PUT", | ||
| "CONNECT" | ||
| ] | ||
| } | ||
| ], | ||
| "refererWhiteList": [], | ||
| "cookieOptions": { | ||
| "signed": false, | ||
| "httpOnly": false, | ||
| "overwrite": true | ||
| } | ||
| }, | ||
| "xframe": { | ||
| "enable": true, | ||
| "value": "SAMEORIGIN" | ||
| }, | ||
| "hsts": { | ||
| "enable": false, | ||
| "maxAge": 31536000, | ||
| "includeSubdomains": false | ||
| }, | ||
| "methodnoallow": { | ||
| "enable": true | ||
| }, | ||
| "noopen": { | ||
| "enable": true | ||
| }, | ||
| "nosniff": { | ||
| "enable": true | ||
| }, | ||
| "xssProtection": { | ||
| "enable": true, | ||
| "value": "1; mode=block" | ||
| }, | ||
| "csp": { | ||
| "enable": false, | ||
| "policy": {} | ||
| }, | ||
| "referrerPolicy": { | ||
| "enable": false, | ||
| "value": "no-referrer-when-downgrade" | ||
| }, | ||
| "dta": { | ||
| "enable": true | ||
| }, | ||
| "ssrf": {} | ||
| }, | ||
| "helper": { | ||
| "shtml": {} | ||
| } | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,74 @@ | ||
| exports['test/context.test.ts context.isSafeDomain should return false when domains are not safe 1'] = { | ||
| "domainWhiteList": [ | ||
| ".domain.com", | ||
| "http://www.baidu.com", | ||
| "192.*.0.*", | ||
| "*.alibaba.com" | ||
| ], | ||
| "protocolWhiteList": [], | ||
| "defaultMiddleware": "xframe", | ||
| "csrf": { | ||
| "enable": true, | ||
| "type": "ctoken", | ||
| "ignoreJSON": false, | ||
| "cookieName": "csrfToken", | ||
| "sessionName": "csrfToken", | ||
| "headerName": "x-csrf-token", | ||
| "bodyName": "_csrf", | ||
| "queryName": "_csrf", | ||
| "rotateWhenInvalid": false, | ||
| "useSession": false, | ||
| "supportedRequests": [ | ||
| { | ||
| "path": {}, | ||
| "methods": [ | ||
| "POST", | ||
| "PATCH", | ||
| "DELETE", | ||
| "PUT", | ||
| "CONNECT" | ||
| ] | ||
| } | ||
| ], | ||
| "refererWhiteList": [], | ||
| "cookieOptions": { | ||
| "signed": false, | ||
| "httpOnly": false, | ||
| "overwrite": true | ||
| } | ||
| }, | ||
| "xframe": { | ||
| "enable": true, | ||
| "value": "SAMEORIGIN" | ||
| }, | ||
| "hsts": { | ||
| "enable": false, | ||
| "maxAge": 31536000, | ||
| "includeSubdomains": false | ||
| }, | ||
| "methodnoallow": { | ||
| "enable": true | ||
| }, | ||
| "noopen": { | ||
| "enable": true | ||
| }, | ||
| "nosniff": { | ||
| "enable": true | ||
| }, | ||
| "xssProtection": { | ||
| "enable": true, | ||
| "value": "1; mode=block" | ||
| }, | ||
| "csp": { | ||
| "enable": false, | ||
| "policy": {} | ||
| }, | ||
| "referrerPolicy": { | ||
| "enable": false, | ||
| "value": "no-referrer-when-downgrade" | ||
| }, | ||
| "dta": { | ||
| "enable": true | ||
| }, | ||
| "ssrf": {} | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,93 @@ | ||
| exports['test/csp.test.ts should ignore path 1'] = { | ||
| "domainWhiteList": [], | ||
| "protocolWhiteList": [], | ||
| "defaultMiddleware": "csp", | ||
| "csrf": { | ||
| "enable": true, | ||
| "type": "ctoken", | ||
| "ignoreJSON": false, | ||
| "cookieName": "csrfToken", | ||
| "sessionName": "csrfToken", | ||
| "headerName": "x-csrf-token", | ||
| "bodyName": "_csrf", | ||
| "queryName": "_csrf", | ||
| "rotateWhenInvalid": false, | ||
| "useSession": false, | ||
| "supportedRequests": [ | ||
| { | ||
| "path": {}, | ||
| "methods": [ | ||
| "POST", | ||
| "PATCH", | ||
| "DELETE", | ||
| "PUT", | ||
| "CONNECT" | ||
| ] | ||
| } | ||
| ], | ||
| "refererWhiteList": [], | ||
| "cookieOptions": { | ||
| "signed": false, | ||
| "httpOnly": false, | ||
| "overwrite": true | ||
| } | ||
| }, | ||
| "xframe": { | ||
| "enable": true, | ||
| "value": "SAMEORIGIN" | ||
| }, | ||
| "hsts": { | ||
| "enable": false, | ||
| "maxAge": 31536000, | ||
| "includeSubdomains": false | ||
| }, | ||
| "methodnoallow": { | ||
| "enable": true | ||
| }, | ||
| "noopen": { | ||
| "enable": true | ||
| }, | ||
| "nosniff": { | ||
| "enable": true | ||
| }, | ||
| "xssProtection": { | ||
| "enable": true, | ||
| "value": "1; mode=block" | ||
| }, | ||
| "csp": { | ||
| "enable": true, | ||
| "policy": { | ||
| "script-src": [ | ||
| "'self'", | ||
| "'unsafe-inline'", | ||
| "'unsafe-eval'", | ||
| "www.google-analytics.com" | ||
| ], | ||
| "style-src": [ | ||
| "'unsafe-inline'", | ||
| "www.google-analytics.com" | ||
| ], | ||
| "img-src": [ | ||
| "'self'", | ||
| "data:", | ||
| "www.google-analytics.com" | ||
| ], | ||
| "frame-ancestors": [ | ||
| "'self'" | ||
| ], | ||
| "report-uri": "http://pointman.domain.com/csp?app=csp" | ||
| }, | ||
| "ignore": [ | ||
| "/api/", | ||
| {} | ||
| ] | ||
| }, | ||
| "referrerPolicy": { | ||
| "enable": false, | ||
| "value": "no-referrer-when-downgrade" | ||
| }, | ||
| "dta": { | ||
| "enable": true | ||
| }, | ||
| "ssrf": {} | ||
| } |
Oops, something went wrong.