Skip to content

Commit a11661f

Browse files
fengmk2coderabbitai[bot]
fengmk2
and
coderabbitai[bot]
authored
feat: support cjs and esm both by tshy (#101)
BREAKING CHANGE: drop Node.js < 18.19.0 support part of eggjs/egg#3644 eggjs/egg#5257 <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit Based on the comprehensive changes, here are the updated release notes: - **New Features** - Migrated security plugin to TypeScript. - Enhanced type safety for security configurations. - Improved middleware and helper utilities. - Introduced new middleware for handling `Strict-Transport-Security`, `X-Frame-Options`, and `X-XSS-Protection` headers. - Added support for new security configurations and helper functions. - **Breaking Changes** - Renamed package from `egg-security` to `@eggjs/security`. - Dropped support for Node.js versions below 18.19.0. - Restructured module exports and configurations. - Removed several deprecated middleware and utility functions. - **Security Improvements** - Updated CSRF, XSS, and SSRF protection mechanisms. - Enhanced middleware for handling security headers. - Refined configuration options for various security features. - **Performance** - Modernized codebase with ES module syntax. - Improved type definitions and module structure. - Enhanced test suite with TypeScript support and better resource management. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
1 parent e340840 commit a11661f

File tree

135 files changed

+2359
-1385
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

135 files changed

+2359
-1385
lines changed

‎.eslintignore

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,3 @@
11
test/fixtures
2-
test/benchmark
32
coverage
4-
node_modules
5-
lib/plugins/**/app/proxy
3+
__snapshots__

‎.eslintrc

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"extends": [
3-
"eslint-config-egg",
3+
"eslint-config-egg/typescript",
44
"eslint-config-egg/lib/rules/enforce-node-prefix"
55
]
66
}

‎.github/workflows/nodejs.yml

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,6 @@ jobs:
1111
name: Node.js
1212
uses: node-modules/github-actions/.github/workflows/node-test.yml@master
1313
with:
14-
os: 'ubuntu-latest, macos-latest, windows-latest'
15-
version: '14.20.0, 14, 16, 18, 20, 22'
14+
version: '18.19.0, 20, 22'
1615
secrets:
1716
CODECOV_TOKEN: ${{ secrets.CODECOV_TOKEN }}

‎.gitignore

Lines changed: 9 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
node_modules
2-
coverage
3-
test/**/logs
4-
_book
5-
.DS_Store
1+
logs/
62
npm-debug.log
7-
run/
8-
.vscode
3+
node_modules/
4+
coverage/
5+
test/fixtures/**/run
6+
.DS_Store
7+
.tshy*
8+
.eslintcache
9+
dist
910
package-lock.json
10-
.travis.yml
11-
.idea
11+
.package-lock.json

‎README.md

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,29 @@
1-
# egg-security
2-
3-
Security plugin in egg
1+
# @eggjs/security
42

53
[![NPM version][npm-image]][npm-url]
64
[![Node.js CI](https://github.com/eggjs/security/actions/workflows/nodejs.yml/badge.svg)](https://github.com/eggjs/security/actions/workflows/nodejs.yml)
75
[![Test coverage][codecov-image]][codecov-url]
86
[![Known Vulnerabilities][snyk-image]][snyk-url]
97
[![npm download][download-image]][download-url]
8+
[![Node.js Version](https://img.shields.io/node/v/eggjs/security.svg?style=flat)](https://nodejs.org/en/download/)
9+
[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)
10+
![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/eggjs/security)
1011

11-
[npm-image]: https://img.shields.io/npm/v/egg-security.svg?style=flat-square
12-
[npm-url]: https://npmjs.org/package/egg-security
12+
[npm-image]: https://img.shields.io/npm/v/@eggjs/security.svg?style=flat-square
13+
[npm-url]: https://npmjs.org/package/@eggjs/security
1314
[codecov-image]: https://codecov.io/gh/eggjs/security/branch/master/graph/badge.svg
1415
[codecov-url]: https://codecov.io/gh/eggjs/security
15-
[snyk-image]: https://snyk.io/test/npm/egg-security/badge.svg?style=flat-square
16-
[snyk-url]: https://snyk.io/test/npm/egg-security
17-
[download-image]: https://img.shields.io/npm/dm/egg-security.svg?style=flat-square
18-
[download-url]: https://npmjs.org/package/egg-security
16+
[snyk-image]: https://snyk.io/test/npm/@eggjs/security/badge.svg?style=flat-square
17+
[snyk-url]: https://snyk.io/test/npm/@eggjs/security
18+
[download-image]: https://img.shields.io/npm/dm/@eggjs/security.svg?style=flat-square
19+
[download-url]: https://npmjs.org/package/@eggjs/security
1920

2021
Egg's default security plugin, generally no need to configure.
2122

2223
## Install
2324

2425
```bash
25-
npm i egg-security
26+
npm i @eggjs/security
2627
```
2728

2829
## Usage & configuration

‎README.zh-CN.md

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,24 @@
1-
# egg-security
2-
3-
egg 内置的安全插件
1+
# @eggjs/security
42

53
[![NPM version][npm-image]][npm-url]
64
[![Node.js CI](https://github.com/eggjs/security/actions/workflows/nodejs.yml/badge.svg)](https://github.com/eggjs/security/actions/workflows/nodejs.yml)
75
[![Test coverage][codecov-image]][codecov-url]
86
[![Known Vulnerabilities][snyk-image]][snyk-url]
97
[![npm download][download-image]][download-url]
8+
[![Node.js Version](https://img.shields.io/node/v/eggjs/security.svg?style=flat)](https://nodejs.org/en/download/)
9+
[![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg?style=flat-square)](https://makeapullrequest.com)
10+
![CodeRabbit Pull Request Reviews](https://img.shields.io/coderabbit/prs/github/eggjs/security)
1011

11-
[npm-image]: https://img.shields.io/npm/v/egg-security.svg?style=flat-square
12-
[npm-url]: https://npmjs.org/package/egg-security
12+
[npm-image]: https://img.shields.io/npm/v/@eggjs/security.svg?style=flat-square
13+
[npm-url]: https://npmjs.org/package/@eggjs/security
1314
[codecov-image]: https://codecov.io/gh/eggjs/security/branch/master/graph/badge.svg
1415
[codecov-url]: https://codecov.io/gh/eggjs/security
15-
[snyk-image]: https://snyk.io/test/npm/egg-security/badge.svg?style=flat-square
16-
[snyk-url]: https://snyk.io/test/npm/egg-security
17-
[download-image]: https://img.shields.io/npm/dm/egg-security.svg?style=flat-square
18-
[download-url]: https://npmjs.org/package/egg-security
16+
[snyk-image]: https://snyk.io/test/npm/@eggjs/security/badge.svg?style=flat-square
17+
[snyk-url]: https://snyk.io/test/npm/@eggjs/security
18+
[download-image]: https://img.shields.io/npm/dm/@eggjs/security.svg?style=flat-square
19+
[download-url]: https://npmjs.org/package/@eggjs/security
20+
21+
egg 内置的安全插件
1922

2023
## 使用方式
2124

‎__snapshots__/config.default.test.ts.js

Lines changed: 84 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,84 @@
1+
exports['test/config/config.default.test.ts should config default values keep stable 1'] = {
2+
"security": {
3+
"domainWhiteList": [],
4+
"protocolWhiteList": [],
5+
"defaultMiddleware": [
6+
"csrf",
7+
"hsts",
8+
"methodnoallow",
9+
"noopen",
10+
"nosniff",
11+
"csp",
12+
"xssProtection",
13+
"xframe",
14+
"dta"
15+
],
16+
"csrf": {
17+
"enable": true,
18+
"type": "ctoken",
19+
"ignoreJSON": false,
20+
"cookieName": "csrfToken",
21+
"sessionName": "csrfToken",
22+
"headerName": "x-csrf-token",
23+
"bodyName": "_csrf",
24+
"queryName": "_csrf",
25+
"rotateWhenInvalid": false,
26+
"useSession": false,
27+
"supportedRequests": [
28+
{
29+
"path": {},
30+
"methods": [
31+
"POST",
32+
"PATCH",
33+
"DELETE",
34+
"PUT",
35+
"CONNECT"
36+
]
37+
}
38+
],
39+
"refererWhiteList": [],
40+
"cookieOptions": {
41+
"signed": false,
42+
"httpOnly": false,
43+
"overwrite": true
44+
}
45+
},
46+
"xframe": {
47+
"enable": true,
48+
"value": "SAMEORIGIN"
49+
},
50+
"hsts": {
51+
"enable": false,
52+
"maxAge": 31536000,
53+
"includeSubdomains": false
54+
},
55+
"methodnoallow": {
56+
"enable": true
57+
},
58+
"noopen": {
59+
"enable": true
60+
},
61+
"nosniff": {
62+
"enable": true
63+
},
64+
"xssProtection": {
65+
"enable": true,
66+
"value": "1; mode=block"
67+
},
68+
"csp": {
69+
"enable": false,
70+
"policy": {}
71+
},
72+
"referrerPolicy": {
73+
"enable": false,
74+
"value": "no-referrer-when-downgrade"
75+
},
76+
"dta": {
77+
"enable": true
78+
},
79+
"ssrf": {}
80+
},
81+
"helper": {
82+
"shtml": {}
83+
}
84+
}

‎__snapshots__/context.test.ts.js

Lines changed: 74 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,74 @@
1+
exports['test/context.test.ts context.isSafeDomain should return false when domains are not safe 1'] = {
2+
"domainWhiteList": [
3+
".domain.com",
4+
"http://www.baidu.com",
5+
"192.*.0.*",
6+
"*.alibaba.com"
7+
],
8+
"protocolWhiteList": [],
9+
"defaultMiddleware": "xframe",
10+
"csrf": {
11+
"enable": true,
12+
"type": "ctoken",
13+
"ignoreJSON": false,
14+
"cookieName": "csrfToken",
15+
"sessionName": "csrfToken",
16+
"headerName": "x-csrf-token",
17+
"bodyName": "_csrf",
18+
"queryName": "_csrf",
19+
"rotateWhenInvalid": false,
20+
"useSession": false,
21+
"supportedRequests": [
22+
{
23+
"path": {},
24+
"methods": [
25+
"POST",
26+
"PATCH",
27+
"DELETE",
28+
"PUT",
29+
"CONNECT"
30+
]
31+
}
32+
],
33+
"refererWhiteList": [],
34+
"cookieOptions": {
35+
"signed": false,
36+
"httpOnly": false,
37+
"overwrite": true
38+
}
39+
},
40+
"xframe": {
41+
"enable": true,
42+
"value": "SAMEORIGIN"
43+
},
44+
"hsts": {
45+
"enable": false,
46+
"maxAge": 31536000,
47+
"includeSubdomains": false
48+
},
49+
"methodnoallow": {
50+
"enable": true
51+
},
52+
"noopen": {
53+
"enable": true
54+
},
55+
"nosniff": {
56+
"enable": true
57+
},
58+
"xssProtection": {
59+
"enable": true,
60+
"value": "1; mode=block"
61+
},
62+
"csp": {
63+
"enable": false,
64+
"policy": {}
65+
},
66+
"referrerPolicy": {
67+
"enable": false,
68+
"value": "no-referrer-when-downgrade"
69+
},
70+
"dta": {
71+
"enable": true
72+
},
73+
"ssrf": {}
74+
}

‎__snapshots__/csp.test.ts.js

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
exports['test/csp.test.ts should ignore path 1'] = {
2+
"domainWhiteList": [],
3+
"protocolWhiteList": [],
4+
"defaultMiddleware": "csp",
5+
"csrf": {
6+
"enable": true,
7+
"type": "ctoken",
8+
"ignoreJSON": false,
9+
"cookieName": "csrfToken",
10+
"sessionName": "csrfToken",
11+
"headerName": "x-csrf-token",
12+
"bodyName": "_csrf",
13+
"queryName": "_csrf",
14+
"rotateWhenInvalid": false,
15+
"useSession": false,
16+
"supportedRequests": [
17+
{
18+
"path": {},
19+
"methods": [
20+
"POST",
21+
"PATCH",
22+
"DELETE",
23+
"PUT",
24+
"CONNECT"
25+
]
26+
}
27+
],
28+
"refererWhiteList": [],
29+
"cookieOptions": {
30+
"signed": false,
31+
"httpOnly": false,
32+
"overwrite": true
33+
}
34+
},
35+
"xframe": {
36+
"enable": true,
37+
"value": "SAMEORIGIN"
38+
},
39+
"hsts": {
40+
"enable": false,
41+
"maxAge": 31536000,
42+
"includeSubdomains": false
43+
},
44+
"methodnoallow": {
45+
"enable": true
46+
},
47+
"noopen": {
48+
"enable": true
49+
},
50+
"nosniff": {
51+
"enable": true
52+
},
53+
"xssProtection": {
54+
"enable": true,
55+
"value": "1; mode=block"
56+
},
57+
"csp": {
58+
"enable": true,
59+
"policy": {
60+
"script-src": [
61+
"'self'",
62+
"'unsafe-inline'",
63+
"'unsafe-eval'",
64+
"www.google-analytics.com"
65+
],
66+
"style-src": [
67+
"'unsafe-inline'",
68+
"www.google-analytics.com"
69+
],
70+
"img-src": [
71+
"'self'",
72+
"data:",
73+
"www.google-analytics.com"
74+
],
75+
"frame-ancestors": [
76+
"'self'"
77+
],
78+
"report-uri": "http://pointman.domain.com/csp?app=csp"
79+
},
80+
"ignore": [
81+
"/api/",
82+
{}
83+
]
84+
},
85+
"referrerPolicy": {
86+
"enable": false,
87+
"value": "no-referrer-when-downgrade"
88+
},
89+
"dta": {
90+
"enable": true
91+
},
92+
"ssrf": {}
93+
}

0 commit comments

Comments
 (0)