sjinks/inline-csp-hash

Plugin to generate hash for inline scripts and styles for CSP

inline-csp-hash

DEPRECATED - please use @localnerve/csp-hashes instead

Plugin to generate hash for inline scripts and styles for CSP.

This plugin is insipred by hash-csp, and operates mostly the same way.

Installation

npm install inline-csp-hash --save

Usage

const gulp = require('gulp');
const hashstream = require('inline-csp-hash');

gulp.task('inline-hash', () => {
  return gulp.src('src/*.html')
    .pipe(hashstream({
      what: 'script',
      replace_cb: (s, hashes) => s.replace(/script-src 'self'[^;]*/, "script-src 'self' " + hashes.join(" "))
    }))
    .pipe(hashstream({
      what: 'style',
      replace_cb: (s, hashes) => s.replace(/style-src 'self'[^;]*/, "style-src 'self' " + hashes.join(" "))
    }))
    .pipe(gulp.dest('dist/'))
  ;
});

Options

• what: script (default) or style: which tags to process (scripts and styles are processed separately because they are controlled by different CSP directives: script-src and style-src)
• hash: sha256 (default), sha384, or sha512: hash algorithm to use. SHA family is the only one according to the specification
• replace_cb: callback to inject gathered hashes into the source file

Tests

Have mocha installed and run npm test

inline-csp-hash's Issues

Missing dependency: Cheerio

This module seems to rely on Cheerio, but it's listed only as a development dependency.

Don't understand the project

Hello !

I use this module to generate the hash of all my inline style. However, I can't understand how the module works. And how to make it work

What I need at the output: My CSP with all the hashes of my site.

With the GitHub example then trying to reread the module code I don't understand: I see that in the module replaces the hashes directly in the .html file. Why?

Thanks !

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Other Branches

These updates are pending. To force PRs open, click the checkbox below.

• chore(deps): lock file maintenance

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

• chore(deps): update actions/setup-node action to v3.5.1

Detected dependencies

github-actions

.github/workflows/build.yml

• actions/checkout v3.1.0@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
• actions/setup-node v3.4.1@2fddd8803e2f5c9604345a0b591c3020ee971a93

.github/workflows/npm-publish.yml

• actions/checkout v3.1.0@93ea575cb5d8a053eaa0ac8fa3b40d7e05a33cc8
• actions/setup-node v3.4.1@2fddd8803e2f5c9604345a0b591c3020ee971a93

npm

package.json

• cheerio ^1.0.0-rc.3
• through2 ^4.0.2
• chai ^4.3.4
• mocha ^10.0.0
• nyc ^15.1.0
• vinyl ^3.0.0

---

• Check this box to trigger a request for Renovate to run again on this repository