fix: handle CSP 'none' keyword correctly in buildCspHeader()#10
fix: handle CSP 'none' keyword correctly in buildCspHeader()#10
Conversation
Fixes invalid CSP headers where 'none' was incorrectly retained alongside other sources (e.g., "frame-src 'none' https://youtube.com"). According to the CSP specification, 'none' must be the only value in a directive. Added comprehensive 'none' keyword handling with three cases: - Remove 'none' when other sources are added to a directive - Clear directive and set only 'none' when user explicitly sets it alone - Filter 'none' from user values if mixed with other sources This eliminates browser console warnings like "Ignoring unknown option 'none'" and ensures CSP headers are fully spec-compliant. Changes: - src/internal/csp-builder.ts: Added 'none' keyword handling logic - test/csp-builder.test.ts: Added 23 comprehensive tests covering all edge cases - .changeset/fix-csp-none-keyword.md: Patch version bump for the fix All 51 tests pass (48 existing + 3 new edge case tests). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <noreply@anthropic.com>
🦋 Changeset detectedLatest commit: e664f82 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Summary of ChangesHello @Enalmada, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request addresses two key areas: it fixes an issue where Content Security Policy (CSP) headers were incorrectly generated with the Highlights
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This is a great pull request that addresses an important correctness issue with CSP header generation. The logic to handle the 'none' keyword is well-implemented and follows the CSP specification correctly. I particularly appreciate the comprehensive suite of new tests, which covers all edge cases and gives high confidence in the fix. The updates to make the default script directives stricter by removing redundant sources when using 'strict-dynamic' is also a solid security improvement.
This PR also includes a significant breaking change by removing the createNonceGetter function due to a critical bug. The new recommended pattern using direct context access is well-documented in the README, and the addition of a detailed migration guide (docs/MIGRATION-1.0-to-1.0.1.md) is excellent practice.
For future PRs of this nature, it would be helpful to summarize all major changes, including breaking ones, in the PR description to provide better context for reviewers.
I have one minor suggestion to clarify a comment in one of the new tests. Otherwise, the code looks excellent.
1 participant
Summary
Fixes invalid CSP headers where
'none'was incorrectly retained alongside other sources, causing browser console warnings and non-compliant CSP directives.Problem:
When users added sources to CSP directives that default to
'none'(frame-src, object-src, child-src, frame-ancestors), the 'none' keyword remained in the directive alongside the new sources, creating invalid CSP like:This caused browser warnings:
Content-Security-Policy: Ignoring unknown option 'none'Root Cause:
The
buildCspHeader()function had its own merge logic that lacked the'none'keyword handling already present inmerger.ts.Solution:
Added comprehensive
'none'keyword handling with three cases:'none'from user values if mixed with other sources (CSP spec violation)'none'when user explicitly sets it alone'none'from directive when adding new sources (fixes the bug)According to the CSP specification,
'none'must be the only value in a directive.Changes
'none'keyword handling logic (lines 85-112)Test Coverage
All 51 tests pass (48 existing + 3 new edge case tests)
New test categories:
'none'defaults (frame-src, object-src, child-src, frame-ancestors)'none', mixed values, whitespace handlingVerification
Before fix:
After fix:
Impact
'none')References
merger.ts(lines 86-90, 144-153)🤖 Generated with Claude Code