{"_id":"strict-csp-html-webpack-plugin","_rev":"6-7c14a296a26159c48b069518aa5d5dfe","name":"strict-csp-html-webpack-plugin","dist-tags":{"beta":"1.0.0-beta.2","latest":"1.0.2"},"versions":{"1.0.0-beta.0":{"name":"strict-csp-html-webpack-plugin","version":"1.0.0-beta.0","description":"A webpack plugin that adds a hash-based strict CSP to help protect your site against XSS attacks.","main":"plugin.js","repository":{"type":"git","url":"git+https://github.com/google/strict-csp.git","directory":"strict-csp-html-webpack-plugin"},"dependencies":{"strict-csp":"^1.0.0"},"devDependencies":{},"scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"author":{"name":"Lukas Weichselbaum","email":"lwe@google.com"},"contributors":[{"name":"Maud Nalpas","email":"maudn@google.com"}],"license":"Apache-2.0","bugs":{"url":"https://github.com/google/strict-csp/issues"},"homepage":"https://github.com/google/strict-csp#readme","_id":"strict-csp-html-webpack-plugin@1.0.0-beta.0","_nodeVersion":"14.16.0","_npmVersion":"6.14.11","dist":{"integrity":"sha512-8AD+NBuJm4eI00zsN5gd0uiAskij7GzsmIPUZQNbmGnSMar5ET/8e2zedKK3V3l9npzyA5V1U9Lhy9VzdYgesg==","shasum":"40f587d1cfc1e35a55918a79e8212796fa14949e","tarball":"https://registry.npmjs.org/strict-csp-html-webpack-plugin/-/strict-csp-html-webpack-plugin-1.0.0-beta.0.tgz","fileCount":3,"unpackedSize":6089,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJgZatbCRA9TVsSAnZWagAAIt4P/0781xJ4zaIxziA70rDh\n4b0ZF4cPi3RrK+e+Knzh9cEvGT0pNAymPfjOmBTcG1PAD3D8/Qg4j3VTyarj\nBqFTz3EBhZi6o1FnZfTGs41LLVqnRQZVhMxZgwUdDh94l7R7ziAH9NZXpaVS\nLJaJwIeEI4EhMmmNcTPkEJ4Kee9Qnzjip6jcIkjBBcqabjJOQDgUttT/LeMM\ns2gbUt1BMs3u6ne35/fKim5f+xI4qZxheiVuqXEk0H0g19JYUdQYbRxBY9z7\njAIDRQozLzRKCjecVH2hmzF3AqZODvBPpcMso9eXJkEHZ/g5mLky9rz0NQ1b\nR2+1ntq8G0IzPefGFW2JKTaQA+Jl7n+bRkIYDT9XcCq5wbs1vKpHy5+iMsSW\nKW4sPwCM9JzGM43h9VFem3U19H5e1c339R9Z3u7rMKbyNcc67KqYNSs2pLgX\nEQFDJ82+q9S+Q5ZN+oPVomylvJAG8UfdCw2oRzf5sMVZP2SxNa1K+2rYJzLV\nTOxdsE2kMvKn4JCqKWgOaUPccdBWjPB3Q1NA7zRocVazZ+9LPlxJO4xPgbob\nNVgzhefX2yzzEdFqFJc6dWfNucAbqvrpQbh72xb4AhXBka5BDglFgfRIGZ7p\ndZf3bZBUf0oFr1uT76bIg89PeY02pITR7vcCYoA7EH5WPDmE+0S64FupVGaw\nXsZ6\r\n=91C7\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQDJ/xgth4SJq61SDMyEekn7xgizLLes3hyRvolxC7mkSgIgeD+2o9eqW9BYnvjs/uAcrN/10OgASf6a9cFK9zlooz4="}]},"_npmUser":{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"},"directories":{},"maintainers":[{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/strict-csp-html-webpack-plugin_1.0.0-beta.0_1617275738462_0.28614213685535916"},"_hasShrinkwrap":false},"1.0.0-beta.1":{"name":"strict-csp-html-webpack-plugin","version":"1.0.0-beta.1","description":"A webpack plugin that adds a hash-based strict CSP to help protect your site against XSS attacks.","main":"plugin.js","repository":{"type":"git","url":"git+https://github.com/google/strict-csp.git","directory":"strict-csp-html-webpack-plugin"},"dependencies":{"strict-csp":"^1.0.0-beta.0"},"devDependencies":{},"scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"author":{"name":"Lukas Weichselbaum","email":"lwe@google.com"},"contributors":[{"name":"Maud Nalpas","email":"maudn@google.com"}],"keywords":["csp","content-security-policy","security"],"license":"Apache-2.0","readme":"⚠️⚠️⚠️⚠️\n\n**This is an MVP. Work in Progress. \nDo not use in production!**\n\n⚠️⚠️⚠️⚠️\n\nstrict-csp-html-webpack-plugin sets up a [strict Content-Security-Policy (CSP)](https://web.dev/strict-csp) to help protect your site against XSS attacks. It's a hash-based CSP.\n\n**This plugin is best-suited for single-page applications. If you have server-side logics, use a nonce-based strict CSP instead.**\n\n## What this plugin does\n\n- It replaces sourced scripts with an inline script that dynamically loads all sourced scripts.\n- It creates a strict hash-based CSP that efficiently helps protect your site against XSS. This CSP is set in a meta tag. It looks like this: `script-src {HASH-INLINE-SCRIPT} 'strict-dynamic'; object-src 'none'; base-uri 'none';`. `{HASH-INLINE-SCRIPT}` is the hash on the inline script that dynamically loads all sources scripts.\n\nNote: if you have other inline scripts, the plugin takes care of them too: it adds their hash to the CSP to ensure they can be loaded.\n\n### How it works\n\nstrict-csp-webpack-plugin uses the `strict-csp` library to form a strict CSP and hooks into `HtmlWebpackPlugin` to set up this CSP as a `meta` HTML tag.\n\n### Not supported\n\n- XML\n- Custom configuration for the hashing algorithm (right now, only sha256)\n- `prefetch` scripts\n\n## Quickstart\n\n### Step 1: install the plugin\n\n`npm i --save strict-csp-html-webpack-plugin`\n\n(or with `yarn`)\n\n### Step 2: Configure the plugin\n\nIn your site's or app's `webpack.config.js`:\n\n```javascript\nconst HtmlWebpackPlugin = require('html-webpack-plugin');\nconst StrictCspHtmlWebpackPlugin = require('strict-csp-html-webpack-plugin');\n\nmodule.exports = function (webpackEnv) {\n  return {\n    // ...\n    plugins: [\n      new HtmlWebpackPlugin(\n        Object.assign(\n          {}\n          // ... HtmlWebpackPlugin config\n        )\n      ),\n      new StrictCspHtmlWebpackPlugin(HtmlWebpackPlugin),\n    ],\n  };\n};\n```\n\n⚠️ If you have a React app created with create-react-app, you'll need to `eject` in order to configure and use this plugin (because you need access to the webpack config).\n\n### Step 3: Restart the app\n\n- The app should run without errors (check the console).\n- Observe that a `meta` HTML tag has been added to the application's `index.html`, and that one inline script now loads all scripts.\n\n✨ Your app is now protected from many XSS attacks.\n\n## Options\n\nBy default, strict-csp-html-webpack-plugin will set up a valid, strict, hash-based CSP.\n\nYou can use additional options to configure the plugin:\n\n| Option               | Default | What it does                                                                                                            |\n| -------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------- |\n| `enabled`            | `true`  | When `true`, activates the plugin.                                                                                      |\n| `enableTrustedTypes` | `true`  | When `true`, enables [trusted types](https://web.dev/trusted-types) for additional protections against DOM XSS attacks. |\n","readmeFilename":"README.md","bugs":{"url":"https://github.com/google/strict-csp/issues"},"homepage":"https://github.com/google/strict-csp#readme","_id":"strict-csp-html-webpack-plugin@1.0.0-beta.1","_nodeVersion":"14.16.0","_npmVersion":"6.14.11","dist":{"integrity":"sha512-3ZfDSroxLV9FVBN8doNEjE3WcTN2Llpo7gCQJ5HrtA5ifvBpm8mF3XPi3ssmZiuVgLailGedQy9heyPcLZ5dkA==","shasum":"bdb7f337c6d4a14dda75d0d2430dd1c79acd2b17","tarball":"https://registry.npmjs.org/strict-csp-html-webpack-plugin/-/strict-csp-html-webpack-plugin-1.0.0-beta.1.tgz","fileCount":3,"unpackedSize":6174,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJgZbDiCRA9TVsSAnZWagAAJbMP/jmefoe4JXmNdCmLdwIu\nRmF4w+dS5r7fky0nx3hu9IWJzWJrHtANfDxrTWwrU7+ppBPnOCSiJYZLB1ll\nriFqfElYQ+gKxbSH3S+bCRS2TsjM+Sc0OApZ5rG1nkJgxfvYkM7frOrPAGSw\nuzzyFa9PbUb0kvFp1f0yOLotEHemgekjni1in2S559TjRwfPDtxGsBElImIX\nkEPUHyrU7A5k+Rpmj+xD0J/JnzYxta0tUTath5Zri8jIuVhIzAiCpkx9WH0/\nHwo6yF9fo34J5lRRL6zgCqyMJ7aIms/f7RIS/+o0CLC4aPDFV2/E95Bs3qxd\nsZo2X4G4srjBCO0acjqGgu3R9N3fhlSG8GV/qrZ92/oe6jFuf/yKg+4ObM65\nkzUgN5mKYPiQTaBCJam2wNuk0HsMZ6afJWlFXNBwN26C2UCaSHUD2gRBJVFX\n4+OuPg4YV+v9yxFjX9+1CNFWl+Tl3X/3gK7ReVx1+t46xT9r4vwRvw88b5mg\ny6lJdyL6U24Fr06QPWHO5XaBrSuFBoYo9wh7NTQ7e5/Q135ybCYhvQqSoJ18\nKrFyrQa5O0z9hw1YQfblw8lKck35P5W3N3arR+KgN/PvsfLQT/QX8tMWznMv\nsRLCR7UYgI7/oWsKXmX6dvBqDN6yUrvv5JzdBXuBmqxGVyVNsHh2uTlzrH5i\ntqS9\r\n=t0cS\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEYCIQC5hPv+NuKRWoZmsoEgVoEHC+3d3y9evgdr788d6GauXgIhAJZGGatv1Z47eRP+qu4yg1dKqDicugaQlMaCDgwx740m"}]},"_npmUser":{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"},"directories":{},"maintainers":[{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/strict-csp-html-webpack-plugin_1.0.0-beta.1_1617277153918_0.13398594025347155"},"_hasShrinkwrap":false},"1.0.0-beta.2":{"name":"strict-csp-html-webpack-plugin","version":"1.0.0-beta.2","description":"A webpack plugin that adds a hash-based strict CSP to help protect your site against XSS attacks.","main":"plugin.js","repository":{"type":"git","url":"git+https://github.com/google/strict-csp.git","directory":"strict-csp-html-webpack-plugin"},"dependencies":{"strict-csp":"^1.0.0-beta.1"},"devDependencies":{},"scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"author":{"name":"Lukas Weichselbaum","email":"lwe@google.com"},"contributors":[{"name":"Maud Nalpas","email":"maudn@google.com"}],"keywords":["csp","content-security-policy","security"],"license":"Apache-2.0","readme":"⚠️⚠️⚠️⚠️\n\n**This is an MVP. Work in Progress. \nDo not use in production!**\n\n⚠️⚠️⚠️⚠️\n\nstrict-csp-html-webpack-plugin sets up a [strict Content-Security-Policy (CSP)](https://web.dev/strict-csp) to help protect your site against XSS attacks. It's a hash-based CSP.\n\n**This plugin is best-suited for single-page applications. If you have server-side logics, use a nonce-based strict CSP instead.**\n\n## What this plugin does\n\n- It replaces sourced scripts with an inline script that dynamically loads all sourced scripts.\n- It creates a strict hash-based CSP that efficiently helps protect your site against XSS. This CSP is set in a meta tag. It looks like this: `script-src {HASH-INLINE-SCRIPT} 'strict-dynamic'; object-src 'none'; base-uri 'none';`. `{HASH-INLINE-SCRIPT}` is the hash on the inline script that dynamically loads all sources scripts.\n\nNote: if you have other inline scripts, the plugin takes care of them too: it adds their hash to the CSP to ensure they can be loaded.\n\n### How it works\n\nstrict-csp-webpack-plugin uses the `strict-csp` library to form a strict CSP and hooks into `HtmlWebpackPlugin` to set up this CSP as a `meta` HTML tag.\n\n### Not supported\n\n- XML\n- Custom configuration for the hashing algorithm (right now, only sha256)\n- `prefetch` scripts\n\n## Quickstart\n\n### Step 1: install the plugin\n\n`npm i --save strict-csp-html-webpack-plugin`\n\n(or with `yarn`)\n\n### Step 2: Configure the plugin\n\nIn your site's or app's `webpack.config.js`:\n\n```javascript\nconst HtmlWebpackPlugin = require('html-webpack-plugin');\nconst StrictCspHtmlWebpackPlugin = require('strict-csp-html-webpack-plugin');\n\nmodule.exports = function (webpackEnv) {\n  return {\n    // ...\n    plugins: [\n      new HtmlWebpackPlugin(\n        Object.assign(\n          {}\n          // ... HtmlWebpackPlugin config\n        )\n      ),\n      new StrictCspHtmlWebpackPlugin(HtmlWebpackPlugin),\n    ],\n  };\n};\n```\n\n⚠️ If you have a React app created with create-react-app, you'll need to `eject` in order to configure and use this plugin (because you need access to the webpack config).\n\n### Step 3: Restart the app\n\n- The app should run without errors (check the console).\n- Observe that a `meta` HTML tag has been added to the application's `index.html`, and that one inline script now loads all scripts.\n\n✨ Your app is now protected from many XSS attacks.\n\n## Options\n\nBy default, strict-csp-html-webpack-plugin will set up a valid, strict, hash-based CSP.\n\nYou can use additional options to configure the plugin:\n\n| Option               | Default | What it does                                                                                                            |\n| -------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------- |\n| `enabled`            | `true`  | When `true`, activates the plugin.                                                                                      |\n| `enableTrustedTypes` | `true`  | When `true`, enables [trusted types](https://web.dev/trusted-types) for additional protections against DOM XSS attacks. |\n","readmeFilename":"README.md","bugs":{"url":"https://github.com/google/strict-csp/issues"},"homepage":"https://github.com/google/strict-csp#readme","_id":"strict-csp-html-webpack-plugin@1.0.0-beta.2","_nodeVersion":"14.16.0","_npmVersion":"6.14.11","dist":{"integrity":"sha512-Pnh7sCeZXK+VNTwDWSfb1LqGFluTZfzQaR9LKVLnZPUTzOYjdGpkwb020y7X57WEQxYiPxOqyLsxZWGZ4EeK0g==","shasum":"3ae146fd34cb1c524f95ea22d2ae08592b6af61a","tarball":"https://registry.npmjs.org/strict-csp-html-webpack-plugin/-/strict-csp-html-webpack-plugin-1.0.0-beta.2.tgz","fileCount":3,"unpackedSize":6174,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJgZbeTCRA9TVsSAnZWagAA6hMP/Aj2+mkTxUYcSJHqtoaK\nuxSBO8SglSDMhprjPn3MLSVoh7yIn2OrXmN3Uos7qG2A9KF9P1r675/T6ksm\nBk48TM+L89g1Zjf9oQmydLpAY9K2+cgipovSu3Acs4CpRXMaKL8990oGKWvQ\nYcdoPEER5MJnervdtbUsMpznufw0/mm3mkjdIoZeIzBNNf/9rJd4QPiU/qwP\nzbDS+1SPh9L0JxOs2Vur/t90orAanUXLImxJ0XVITU1OSrud9FZK2le0KT/y\nYHJ+4Qbli5v/Mvwj4SKVXtuHFgUXPM+SJN1GF4K72tJYe5zeoiTlkQ7zMG5D\nZqRgSvNXSq8QpLToTzEgaSaZcfx+F/thu+vhn1Cbgq1ip+79NENeJRoMiKYd\neqtYFYipp2Muk/tXr/gWibSSNSwO6mQcF7MkQB5ktz8Tsh0kAnYobd9Ksce+\nes09R6NsEO5M4B7G24ma7B94eIKTU4Xz5e1vypMRe9IgKnXi0uWHjX88GSgR\n70pDcUsRgPBqgVk/tcprfEGp9Ku8L1Eo5CtlENvbS+6w8S1pGbKg62fx0Y6r\n5sLkO3SU55neM7Bh+JCKD7cuZ/aaeASZ4pEdbb7mFWFr31pAKHWtfSTKLJp0\ncJZam2vAkAINa8vBGnY1CKHji8/H5HXI0UREGajTLcrskhKXajWdNu2VnwBg\ndp+q\r\n=JBAt\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIBnKsoBMT08C9sC5XN8oBNp9aoE/Bv4MLHo1RAxDIQl4AiA7SUEQWyzD/V49fcrfIBOXT4pHePPYdNx90q2MDNLYMA=="}]},"_npmUser":{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"},"directories":{},"maintainers":[{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/strict-csp-html-webpack-plugin_1.0.0-beta.2_1617278867229_0.7738837290156542"},"_hasShrinkwrap":false},"1.0.1":{"name":"strict-csp-html-webpack-plugin","version":"1.0.1","description":"A webpack plugin that adds a hash-based strict CSP to help protect your site against XSS attacks.","main":"plugin.js","repository":{"type":"git","url":"git+https://github.com/google/strict-csp.git","directory":"strict-csp-html-webpack-plugin"},"dependencies":{"strict-csp":"^1.0.0-beta.1"},"devDependencies":{},"scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"author":{"name":"Lukas Weichselbaum","email":"lwe@google.com"},"contributors":[{"name":"Maud Nalpas","email":"maudn@google.com"}],"keywords":["csp","content-security-policy","security"],"license":"Apache-2.0","bugs":{"url":"https://github.com/google/strict-csp/issues"},"homepage":"https://github.com/google/strict-csp#readme","_id":"strict-csp-html-webpack-plugin@1.0.1","_nodeVersion":"12.22.7","_npmVersion":"6.14.15","dist":{"integrity":"sha512-PPOfZsDiioTyiLYA+NDXKZ7C1CdGJ/ggdJJtUakTvJC6KVpRionrc9JYjZTIsXmcPRLdEi9pMrNNLw5kmITOBg==","shasum":"60a7195c17aec94aa465ed78e34759dcb6c4e505","tarball":"https://registry.npmjs.org/strict-csp-html-webpack-plugin/-/strict-csp-html-webpack-plugin-1.0.1.tgz","fileCount":3,"unpackedSize":6271,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJh28NlCRA9TVsSAnZWagAATNAP/1YYa0si1mA3xRv21oOH\njpZFGEqDGfbdapAyQ8APNMr4bOMUaF4X6gxmz/ApZuRtGD/aTU/8qftpPjnQ\nt+srm1vLJrOJH49VMHczIPLZhfKcmICQKabMdbjrtM23NWME6BmTRKJT+ZfM\n4Trq2bD5TMKXwzoUEw477b6XOe9ZxAEhURGCR22Q9L3f+S1Hl1W2c42FMxMM\n+9mzqy01GXtKGbAqBLhvhTUEENrFPjGlnK/aSQEed50tug36MRB5jGffllaV\nlWJnvmWnbgE7b5xv1c8JulZtEEmvIBo0YsJUdU+clDapz7Q7zNYq9S7hX5sD\nN34eK//dwWTAOskTv6C9ZfF+NHvBAArMij40yQ6wgy6ODlgv1f8F1RHSEMp3\nnmTx1VvTLOX8C84AjVPoaynM4xteSg+DHrz/jMguDnRpjM1AzEKDZNGBtZhl\nDm7iMHdkCa9YoU8f6mqV/OvuLwUvE7HQyKhlO5mTK+RpY4O1DLnZuAfruAWl\nK/nqxWqKSWRLsMVkcXtf1v9AsLX3zIMj9i1M7tolG1AIXVrZeSoqUx/8MnLV\n4CHf60irLAqryBHNVakdIkXV3W9Cy/aE2+9NahxQLazsYPiTA7b7P1tyd8Me\n6ZtVjcjSPUfc04kgg+k6ulAN5w4IzpUiKl4SyS3dcbKX3uOZ+Ghlxha1rkDb\nvHwh\r\n=f34H\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEQCIBOyMdLxS9h+Qe0iGU540OO97vDr4ppByo0jyjMYCK2lAiAIaqDSEwP+4Own/qrD+LIcaHzycG93EdY7YtxxrPe3wg=="}]},"_npmUser":{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"},"directories":{},"maintainers":[{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/strict-csp-html-webpack-plugin_1.0.1_1636119832638_0.3236599667215314"},"_hasShrinkwrap":false},"1.0.2":{"name":"strict-csp-html-webpack-plugin","version":"1.0.2","description":"A webpack plugin that adds a hash-based strict CSP to help protect your site against XSS attacks.","main":"plugin.js","repository":{"type":"git","url":"git+https://github.com/google/strict-csp.git","directory":"strict-csp-html-webpack-plugin"},"dependencies":{"strict-csp":"^1.0.0-beta.1"},"devDependencies":{},"scripts":{"test":"echo \"Error: no test specified\" && exit 1"},"author":{"name":"Lukas Weichselbaum","email":"lwe@google.com"},"contributors":[{"name":"Maud Nalpas","email":"maudn@google.com"}],"keywords":["csp","content-security-policy","security"],"license":"Apache-2.0","bugs":{"url":"https://github.com/google/strict-csp/issues"},"homepage":"https://github.com/google/strict-csp#readme","_id":"strict-csp-html-webpack-plugin@1.0.2","_nodeVersion":"12.22.8","_npmVersion":"6.14.15","dist":{"integrity":"sha512-Pj6xBCVVq9IebaMmzFHr00jFCDna7cd1tPVp6NRypdzeTdCHLl3IpL9X6ZTdEPyrNXYCwqb040oPEzsQLM4Mug==","shasum":"0ce98d0a76f4edf4debd6287f5c735e034078dff","tarball":"https://registry.npmjs.org/strict-csp-html-webpack-plugin/-/strict-csp-html-webpack-plugin-1.0.2.tgz","fileCount":3,"unpackedSize":11091,"npm-signature":"-----BEGIN PGP SIGNATURE-----\r\nVersion: OpenPGP.js v3.0.13\r\nComment: https://openpgpjs.org\r\n\r\nwsFcBAEBCAAQBQJh3FEcCRA9TVsSAnZWagAAmvIP+gN42z9e2OhU1GPrMXIp\n8SvpGJ1HaLlRB9Z8pZKvA2WJme7dJHa03YDET+ECIazQZVfTBkxgvEbRNm2z\nZMBQ/XvsRmHY3AoVYkPB+f/UhXXJah3KvxXjBIgX+CkvExFShz5rh7Fob3Pa\n3kac5JS9aQZ4Bw+l/FTqY0eEr1ov/HDYQHbVRu5XoDRROCKSH69xi4drRddB\nPDH0DGxFdH7PzdXZLQwnGmOlykOtAgaytEkITRDi6aU1sYo2tfBd/v2Ykdk1\nK4BtWcacIR7uqzHItgENutjsqYEU5XeeI7xQdI1heoyiHykp1nBAgM0zbsYy\n3E0LTdvQVKO/DgrwcurmGrPNL6LqXu1jlZRsoOLYUeKePO5iEly/Bjm5HcyM\nb+ghsCpj/fo55DU3E2rUWtPXWm5zA6Dm6mNCYADlR1hiagyr3m+s7qtmNntb\nW8hq8eH7vyQdTxZ6RUOh744URtfYessAzYD+gWIELqOsKItAzYgeFvbQ1gyq\nlds5tMc15C+7/Dmnff72gCeP265tRCe/8FaCME7xf5iqr7Q5LkmCP3nKK+kp\ncI2F3FNkB38sE3bsS80jybQZ1yt76XDCsNaj9kSk4QbIHSCtGXtyNk2U1Fn/\n2b8RGU+Ids2oaWJmhNR9Z+u/7f1t4gyxJ+4lnsbhCrG1yhTNUCp39OYSq3Sq\nMVKg\r\n=ujP7\r\n-----END PGP SIGNATURE-----\r\n","signatures":[{"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","sig":"MEUCIQCD+vaBZJUzTMRIKtUo6NBIQLoszmx5pOd5aMLWDQfjkgIgCsp00AUDHaNCeMbPzy6bThGDJdgSrv3ZUJc3mJ9/YIg="}]},"_npmUser":{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"},"directories":{},"maintainers":[{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages","tmp":"tmp/strict-csp-html-webpack-plugin_1.0.2_1641828635974_0.8705534455208566"},"_hasShrinkwrap":false}},"time":{"created":"2021-04-01T11:15:38.462Z","1.0.0-beta.0":"2021-04-01T11:15:38.599Z","modified":"2022-05-18T20:33:24.015Z","1.0.0-beta.1":"2021-04-01T11:39:14.131Z","1.0.0-beta.2":"2021-04-01T12:07:47.414Z","1.0.1":"2021-11-05T13:43:52.817Z","1.0.2":"2022-01-10T15:30:36.185Z"},"maintainers":[{"name":"lweichselbaum","email":"l.weichselbaum@gmail.com"}],"description":"A webpack plugin that adds a hash-based strict CSP to help protect your site against XSS attacks.","homepage":"https://github.com/google/strict-csp#readme","repository":{"type":"git","url":"git+https://github.com/google/strict-csp.git","directory":"strict-csp-html-webpack-plugin"},"contributors":[{"name":"Maud Nalpas","email":"maudn@google.com"}],"author":{"name":"Lukas Weichselbaum","email":"lwe@google.com"},"bugs":{"url":"https://github.com/google/strict-csp/issues"},"license":"Apache-2.0","readme":"# strict-csp-html-webpack-plugin\n\n[Available on npm](https://www.npmjs.com/package/strict-csp-html-webpack-plugin)\n\n⚠️ This is experimental. Make sure to check [what's not supported](https://github.com/google/strict-csp/issues?q=is%3Aissue+is%3Aopen+label%3Afeature). Keep in mind that the `Report-Only` mode is not supported here since the policy is added via a meta tag (`Content-Security-Policy-Report-Only` is unfortunately not supported in meta tags).\n\n## What this plugin does: defense-in-depth against XSS 🛡\n\n*💡 Not using webpack? Head over to [strict-csp](https://github.com/google/strict-csp/tree/main/strict-csp) instead. It's the bundler-agnostic library this webpack plugin is based on, and it enables you to easily set a strict CSP.*\n\nCross-site scripting (XSS)—the ability to inject malicious scripts into a web application—has been one of the biggest web security vulnerabilities for over a decade.\n\nstrict-csp-html-webpack-plugin helps protect your single-page application against XSS attacks. It does so by configuring a [strict Content-Security-Policy (CSP)](https://web.dev/strict-csp) for your web application. \n\nA strict CSP, added in the form of an HTML `meta` tag, looks as follows:\n\n```html\n<meta \n      http-equiv=\"Content-Security-Policy\" \n      content=\"script-src 'sha256-3uCZp...oQxI=' 'strict-dynamic'; style-src 'self' 'unsafe-inline'\">\n</meta>\n```\n\n## Quickstart 🚀\n\n### Step 1: install the plugin\n\n`npm i --save strict-csp-html-webpack-plugin@beta`\n\n(or with `yarn`)\n\n### Step 2: Configure the plugin\n\nIn your site's or app's `webpack.config.js`:\n\n```javascript\nconst HtmlWebpackPlugin = require('html-webpack-plugin');\nconst StrictCspHtmlWebpackPlugin = require('strict-csp-html-webpack-plugin');\n\nmodule.exports = function (webpackEnv) {\n  return {\n    // ...\n    plugins: [\n      new HtmlWebpackPlugin(\n        Object.assign(\n          {}\n          // ... HtmlWebpackPlugin config\n        )\n      ),\n      new StrictCspHtmlWebpackPlugin(HtmlWebpackPlugin),\n    ],\n  };\n};\n```\n\n⚠️ If you have a React app created with create-react-app, you'll need to `eject` in order to configure and use this plugin (because you need access to the webpack config).\n\n### Step 3: Restart the app\n\n- The app should run without errors (check the console).\n- Observe that a `meta` HTML tag has been added to the application's `index.html`, and that one inline script now loads all scripts.\n\n✨ Your app is now protected from many XSS attacks.\n\n## Options\n\nBy default, strict-csp-html-webpack-plugin will set up a valid, strict, hash-based CSP.\n\nYou can use additional options to configure the plugin:\n\n| Option               | Default | What it does                                                                                                            |\n| -------------------- | ------- | ----------------------------------------------------------------------------------------------------------------------- |\n| `enabled`            | `true`  | When `true`, activates the plugin.                                                                                      |\n| `enableTrustedTypes` | `false`  | When `true`, enables [trusted types](https://web.dev/trusted-types) for additional protections against DOM XSS attacks. |\n| `enableUnsafeEval`   | `false` | When `true`, enables [unsafe-eval](https://web.dev/strict-csp/) in case you cannot remove all uses of `eval()`.         |\n\n## FAQ\n\n### Does this plugin protect my users from XSS attacks?\n\nA CSP offers an *extra* layer of security (also called \"defense-in-depth\" technique) to mitigate XSS attacks. It's not a replacement for properly escaping user-controlled data and sanitizing user input.\n\nNow, this plugin sets a hash-based **strict** CSP. While this does remove several common XSS attack surfaces, it doesn't guarantee that your application is XSS-free.\n\nTo cover most of the XSS attack surface, we recommend to also enable [Trusted Types](https://web.dev/trusted-types/) (DOM XSS).\n\n### Where should I use this plugin?\n\nThis plugin is best-suited for use in single-page applications that are served statically.\nIf you are rendering HTML on the server-side, you will also have to consider stored and reflected XSS. In this case we recommend using a [nonce-based strict CSP](https://web.dev/strict-csp#step-1:-decide-if-you-need-a-nonce-or-hash-based-csp) instead.\n\n### How does this plugin, **strict**-csp-html-webpack-plugin, differ from [csp-html-webpack-plugin](https://www.npmjs.com/package/csp-html-webpack-plugin)?\n\nThis plugin **strict**-csp-html-webpack-plugin focuses on one thing: it mitigates XSS vulnerabilities. It does so by setting up a [strict CSP](https://web.dev/strict-csp), that is, an efficient defense-in-depth mechanism against XSS attacks.\nIt automatically sets up a secure CSP and frees you from manual configurations.\n\ncsp-html-webpack-plugin on the other hand, has a numbers of options to choose from. If you're using a CSP for other purposes than XSS mitigation, check out [csp-html-webpack-plugin](https://www.npmjs.com/package/csp-html-webpack-plugin). Note that at the moment, static nonces risk making csp-html-webpack-plugin's CSP bypassable, though this may be resolved in the future.\n\n### I already have a CSP on my site, with an allowlist*. Should I consider using this plugin?\n*An allowlist CSP looks as follows: `default-src https://cdn.example https://site1.example https://site2.example;`.\n\nIt depends.\n\nIf you're using your allowlist CSP purely to load scripts coming from a certain origin, you can keep using it.\n\nBut if you're relying on your allowlist CSP for XSS protection: migrate to the more secure strict CSP approach, and consider using this plugin to help you do so.\n\nAllowlist-based CSP are not recommended anymore for XSS protection, because don't efficiently protect sites against XSS attacks: [research has shown that they can be bypassed](https://research.google/pubs/pub45542/). 🥲\nThey're also harder to maintain!\n\nInstead, strict CSPs are now recommended, because they're both [more secure and easier to maintain than allowlist-based CSPs](https://web.dev/strict-csp/#why-a-strict-csp-is-recommended-over-allowlist-csps).\n\nThis plugin automatically adds a strict CSP to your application.\n\n### Can this plugin slow down my site?\n\nSee [issue #15](https://github.com/google/strict-csp/issues/15).\n\n### How does a strict CSP compare with subresource integrity (SRI)?\n\nSRI can be used to ensure the integrity of scripts, e.g. to protect your site in case your CDN gets compromised.\nHowever, SRI will not mitigate XSS caused by an injection vulnerability *in your own site*.\n\n### Why should sourced scripts be replaced by an inline script?\n\nA strict hash-based CSP allows certain scripts based on their hash.\nHowever, Firefox ([bug](https://bugzilla.mozilla.org/show_bug.cgi?id=1409200)) and Safari (bug) do not support hashes for externally-sourced scripts⏤only for inline scripts.\nBecause this plugin aims at setting a CSP that helps protect your users in all browsers, it first transforms your externally-sourced scripts into an inline script.\n\n### How does this plugin work?\n\nstrict-csp-webpack-plugin uses the [strict-csp](https://github.com/google/strict-csp/tree/main/strict-csp) custom library to form a strict CSP and hooks into `HtmlWebpackPlugin` to set up this CSP as a `meta` HTML tag.\n\nLearn more about what the strict-csp library exactly does [here](https://github.com/google/strict-csp/tree/main/strict-csp).\n\n**TL;DR: this library automates the steps to [add a hash-based strict CSP to your site](https://web.dev/strict-csp/#adopting-a-strict-csp).**\n\n## Resources\n* [Mitigate cross-site scripting (XSS) with a strict Content Security Policy (CSP)](https://web.dev/strict-csp/)\n\n\n","readmeFilename":"README.md","keywords":["csp","content-security-policy","security"]}