diff --git a/package.json b/package.json index e8e08ab..7e1a537 100644 --- a/package.json +++ b/package.json @@ -5551,14 +5551,14 @@ "@typescript-eslint/parser": "2.0.0", "circular-dependency-plugin": "5.2.0", "clean-webpack-plugin": "3.0.0", + "csp-html-webpack-plugin": "3.0.3", "css-loader": "3.2.0", - "eslint": "6.2.2", + "eslint": "6.3.0", "eslint-cli": "1.1.1", "eslint-config-prettier": "6.1.0", "eslint-plugin-import": "2.18.2", "fork-ts-checker-webpack-plugin": "1.5.0", "html-webpack-exclude-assets-plugin": "0.0.7", - "html-webpack-inline-source-plugin": "0.0.10", "html-webpack-plugin": "3.2.0", "imagemin-webpack-plugin": "2.4.2", "mini-css-extract-plugin": "0.8.0", diff --git a/src/webviews/settingsWebview.ts b/src/webviews/settingsWebview.ts index 7af7dbe..b89f066 100644 --- a/src/webviews/settingsWebview.ts +++ b/src/webviews/settingsWebview.ts @@ -91,9 +91,9 @@ export class SettingsWebview extends WebviewBase { scope: 'user', scopes: scopes }; - return ` `; + return ``; } registerCommands() { diff --git a/src/webviews/welcomeWebview.ts b/src/webviews/welcomeWebview.ts index 7f7df55..44732a6 100644 --- a/src/webviews/welcomeWebview.ts +++ b/src/webviews/welcomeWebview.ts @@ -31,8 +31,8 @@ export class WelcomeWebview extends WebviewBase { const bootstrap: WelcomeState = { config: Container.config }; - return ` `; + return ``; } } diff --git a/webpack.config.js b/webpack.config.js index 3809ae0..82f3caa 100644 --- a/webpack.config.js +++ b/webpack.config.js @@ -7,9 +7,9 @@ const webpack = require('webpack'); const BundleAnalyzerPlugin = require('webpack-bundle-analyzer').BundleAnalyzerPlugin; const { CleanWebpackPlugin: CleanPlugin } = require('clean-webpack-plugin'); const CircularDependencyPlugin = require('circular-dependency-plugin'); +const CspHtmlPlugin = require('csp-html-webpack-plugin'); const ForkTsCheckerPlugin = require('fork-ts-checker-webpack-plugin'); const HtmlExcludeAssetsPlugin = require('html-webpack-exclude-assets-plugin'); -const HtmlInlineSourcePlugin = require('html-webpack-inline-source-plugin'); const HtmlPlugin = require('html-webpack-plugin'); const ImageminPlugin = require('imagemin-webpack-plugin').default; const MiniCssExtractPlugin = require('mini-css-extract-plugin'); @@ -131,6 +131,17 @@ function getWebviewsConfig(env) { clean.push(path.resolve(__dirname, 'images/settings/*')); } + const cspPolicy = { + 'default-src': "'none'", + 'img-src': ['vscode-resource:', 'https:', 'data:'], + 'script-src': ['vscode-resource:', "'nonce-Z2l0bGVucy1ib290c3RyYXA='"], + 'style-src': ['vscode-resource:'] + }; + + if (!env.production) { + cspPolicy['script-src'].push("'unsafe-eval'"); + } + /** * @type any[] */ @@ -152,6 +163,14 @@ function getWebviewsConfig(env) { filename: path.resolve(__dirname, 'dist/webviews/settings.html'), inject: true, // inlineSource: env.production ? '.(js|css)$' : undefined, + cspPlugin: { + enabled: true, + policy: cspPolicy, + nonceEnabled: { + 'script-src': true, + 'style-src': true + } + }, minify: env.production ? { removeComments: true, @@ -172,6 +191,14 @@ function getWebviewsConfig(env) { filename: path.resolve(__dirname, 'dist/webviews/welcome.html'), inject: true, // inlineSource: env.production ? '.(js|css)$' : undefined, + cspPlugin: { + enabled: true, + policy: cspPolicy, + nonceEnabled: { + 'script-src': true, + 'style-src': true + } + }, minify: env.production ? { removeComments: true, @@ -186,7 +213,7 @@ function getWebviewsConfig(env) { : false }), new HtmlExcludeAssetsPlugin(), - new HtmlInlineSourcePlugin(), + new CspHtmlPlugin(), new ImageminPlugin({ disable: !env.optimizeImages, externalImages: { diff --git a/yarn.lock b/yarn.lock index d865a22..2fd376b 100644 --- a/yarn.lock +++ b/yarn.lock @@ -119,9 +119,9 @@ integrity sha512-tHq6qdbT9U1IRSGf14CL0pUlULksvY9OZ+5eEgl1N7t+OA3tGvNpxJCzuKQlsNgCVwbAs670L1vcVQi8j9HjnA== "@types/node@*": - version "12.7.2" - resolved "https://registry.yarnpkg.com/@types/node/-/node-12.7.2.tgz#c4e63af5e8823ce9cc3f0b34f7b998c2171f0c44" - integrity sha512-dyYO+f6ihZEtNPDcWNR1fkoTDf3zAK3lAABDze3mz6POyIercH0lEUawUFXlG8xaQZmm1yEBON/4TsYv/laDYg== + version "12.7.3" + resolved "https://registry.yarnpkg.com/@types/node/-/node-12.7.3.tgz#27b3f40addaf2f580459fdb405222685542f907a" + integrity sha512-3SiLAIBkDWDg6vFo0+5YJyHPWU9uwu40Qe+v+0MH8wRKYBimHvvAOyk3EzMrD/TrIlLYfXrqDqrg913PynrMJQ== "@types/node@10.14.16": version "10.14.16" @@ -1110,7 +1110,7 @@ check-types@^8.0.3: resolved "https://registry.yarnpkg.com/check-types/-/check-types-8.0.3.tgz#3356cca19c889544f2d7a95ed49ce508a0ecf552" integrity sha512-YpeKZngUmG65rLudJ4taU7VLkOCTMhNl/u4ctNC56LQS/zJTyNH0Lrtwm1tfTsbLlwvlfsA2d1c8vCf/Kh2KwQ== -cheerio@^1.0.0-rc.1: +cheerio@^1.0.0-rc.1, cheerio@^1.0.0-rc.2: version "1.0.0-rc.3" resolved "https://registry.yarnpkg.com/cheerio/-/cheerio-1.0.0-rc.3.tgz#094636d425b2e9c0f4eb91a46c05630c9a1a8bf6" integrity sha512-0td5ijfUPuubwLUu0OBoe98gZj8C/AA+RW3v67GPlGOrvxWjZmBXiBCRU+I8VEiNyJzjth40POfHiz2RB3gImA== @@ -1485,6 +1485,15 @@ crypto-browserify@^3.11.0: randombytes "^2.0.0" randomfill "^1.0.3" +csp-html-webpack-plugin@3.0.3: + version "3.0.3" + resolved "https://registry.yarnpkg.com/csp-html-webpack-plugin/-/csp-html-webpack-plugin-3.0.3.tgz#b2215664ebebbc3ceb84aadff0521f170ce0be65" + integrity sha512-E7IYkTYbh7lY2VpPa8snMrH0muoVCIdPb5dAW9dOX5CFRqeZNsBqqIBejlHJ2cn6rFrrQZ/s/vIh0ZTooBP+xQ== + dependencies: + cheerio "^1.0.0-rc.2" + lodash "^4.17.15" + memory-fs "^0.4.1" + css-loader@3.2.0: version "3.2.0" resolved "https://registry.yarnpkg.com/css-loader/-/css-loader-3.2.0.tgz#bb570d89c194f763627fcf1f80059c6832d009b2" @@ -2123,10 +2132,10 @@ eslint-visitor-keys@^1.0.0, eslint-visitor-keys@^1.1.0: resolved "https://registry.yarnpkg.com/eslint-visitor-keys/-/eslint-visitor-keys-1.1.0.tgz#e2a82cea84ff246ad6fb57f9bde5b46621459ec2" integrity sha512-8y9YjtM1JBJU/A9Kc+SbaOV4y29sSWckBwMHa+FGtVj5gN/sbnKDf6xJUl+8g7FAij9LVaP8C24DUiH/f/2Z9A== -eslint@6.2.2: - version "6.2.2" - resolved "https://registry.yarnpkg.com/eslint/-/eslint-6.2.2.tgz#03298280e7750d81fcd31431f3d333e43d93f24f" - integrity sha512-mf0elOkxHbdyGX1IJEUsNBzCDdyoUgljF3rRlgfyYh0pwGnreLc0jjD6ZuleOibjmnUWZLY2eXwSooeOgGJ2jw== +eslint@6.3.0: + version "6.3.0" + resolved "https://registry.yarnpkg.com/eslint/-/eslint-6.3.0.tgz#1f1a902f67bfd4c354e7288b81e40654d927eb6a" + integrity sha512-ZvZTKaqDue+N8Y9g0kp6UPZtS4FSY3qARxBs7p4f0H0iof381XHduqVerFWtK8DPtKmemqbqCFENWSQgPR/Gow== dependencies: "@babel/code-frame" "^7.0.0" ajv "^6.10.0" @@ -3139,15 +3148,6 @@ html-webpack-exclude-assets-plugin@0.0.7: resolved "https://registry.yarnpkg.com/html-webpack-exclude-assets-plugin/-/html-webpack-exclude-assets-plugin-0.0.7.tgz#ee69906adb3d869e4e29f29b0f3e99b53fa87c99" integrity sha512-gaYKMGBPDts3Fb1WXyDEEcS/0TSRg2IDl3EsbQL2AkKWTqdjSKwfQ8Iz0RhPiWErJfqhq5/wkhoYyjQoG55pug== -html-webpack-inline-source-plugin@0.0.10: - version "0.0.10" - resolved "https://registry.yarnpkg.com/html-webpack-inline-source-plugin/-/html-webpack-inline-source-plugin-0.0.10.tgz#89bd5f761e4f16902aa76a44476eb52831c9f7f0" - integrity sha512-0ZNU57u7283vrXSF5a4VDnVOMWiSwypKIp1z/XfXWoVHLA1r3Xmyxx5+Lz+mnthz/UvxL1OAf41w5UIF68Jngw== - dependencies: - escape-string-regexp "^1.0.5" - slash "^1.0.0" - source-map-url "^0.4.0" - html-webpack-plugin@3.2.0: version "3.2.0" resolved "https://registry.yarnpkg.com/html-webpack-plugin/-/html-webpack-plugin-3.2.0.tgz#b01abbd723acaaa7b37b6af4492ebda03d9dd37b" @@ -4213,11 +4213,16 @@ miller-rabin@^4.0.0: bn.js "^4.0.0" brorand "^1.0.1" -mime-db@1.40.0, mime-db@^1.28.0: +mime-db@1.40.0: version "1.40.0" resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.40.0.tgz#a65057e998db090f732a68f6c276d387d4126c32" integrity sha512-jYdeOMPy9vnxEqFRRo6ZvTZ8d9oPb+k18PKoYNYUe2stVEBPPwsln/qWzdbmaIvnhZ9v2P+CuecK+fpUfsV2mA== +mime-db@^1.28.0: + version "1.41.0" + resolved "https://registry.yarnpkg.com/mime-db/-/mime-db-1.41.0.tgz#9110408e1f6aa1b34aef51f2c9df3caddf46b6a0" + integrity sha512-B5gxBI+2K431XW8C2rcc/lhppbuji67nf9v39eH8pkWoZDxnAL0PxdpH32KYRScniF8qDHBDlI+ipgg5WrCUYw== + mime-types@^2.1.12, mime-types@~2.1.19, mime-types@~2.1.24: version "2.1.24" resolved "https://registry.yarnpkg.com/mime-types/-/mime-types-2.1.24.tgz#b6f8d0b3e951efb77dedeca194cff6d16f676f81"