Skip to content

Commit e6d0a18

Browse files
DK09876DK09876
authored
Merge pull request #24 from vectorize-io/Nonces
Update
2 parents 34e8c6d + 0ef54a4 commit e6d0a18

File tree

12 files changed

+42
-30
lines changed

12 files changed

+42
-30
lines changed

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "@vectorize-io/vectorize-connect",
3-
"version": "0.3.7",
3+
"version": "0.4.0",
44
"description": "A simple package for Google Drive authorization and file selection",
55
"main": "dist/index.js",
66
"module": "dist/index.mjs",

‎src/baseOAuth/core/oauth.ts‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -110,9 +110,10 @@ export abstract class BaseOAuth {
110110
/**
111111
* Create an error response for the OAuth callback
112112
* @param error The error to include in the response
113+
* @param nonce Optional nonce for Content Security Policy
113114
* @returns A Response object with the error
114115
*/
115-
protected static createErrorResponse(error: OAuthError): Response {
116+
protected static createErrorResponse(error: OAuthError, nonce?: string): Response {
116117
const htmlContent = `
117118
<!DOCTYPE html>
118119
<html>
@@ -122,15 +123,15 @@ export abstract class BaseOAuth {
122123
body { font-family: Arial, sans-serif; text-align: center; margin-top: 50px; }
123124
.error { color: #f44336; }
124125
</style>
125-
<script>
126+
<script${nonce ? ` nonce="${nonce}"` : ''}>
126127
window.onload = function() {
127128
if (window.opener && window.opener.__oauthHandler) {
128129
const errorObj = ${JSON.stringify({
129130
message: error.message,
130131
code: error.code,
131132
details: error.details
132133
})};
133-
134+
134135
window.opener.__oauthHandler.onError(
135136
new window.opener.__oauthHandler.OAuthError(
136137
errorObj.message,

‎src/baseOAuth/types/index.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -38,6 +38,7 @@ export class OAuthError extends Error {
3838
export interface OAuthConfig {
3939
redirectUri: string;
4040
scopes?: string[];
41+
nonce?: string;
4142
onSuccess?: (selectedFields?: any) => void;
4243
onError?: (error: OAuthError) => void;
4344
}

‎src/baseOAuth/utils/validation.ts‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,10 @@ export function validateConfig(config: OAuthConfig): void {
2727
/**
2828
* Creates an error response for OAuth callbacks
2929
* @param error The error to include in the response
30+
* @param nonce Optional nonce for Content Security Policy
3031
* @returns A Response object with the error
3132
*/
32-
export function createErrorResponse(error: OAuthError): Response {
33+
export function createErrorResponse(error: OAuthError, nonce?: string): Response {
3334
const htmlContent = `
3435
<!DOCTYPE html>
3536
<html>
@@ -39,15 +40,15 @@ export function createErrorResponse(error: OAuthError): Response {
3940
body { font-family: Arial, sans-serif; text-align: center; margin-top: 50px; }
4041
.error { color: #f44336; }
4142
</style>
42-
<script>
43+
<script${nonce ? ` nonce="${nonce}"` : ''}>
4344
window.onload = function() {
4445
if (window.opener && window.opener.__oauthHandler) {
4546
const errorObj = ${JSON.stringify({
4647
message: error.message,
4748
code: error.code,
4849
details: error.details
4950
})};
50-
51+
5152
window.opener.__oauthHandler.onError(
5253
new window.opener.__oauthHandler.OAuthError(
5354
errorObj.message,

‎src/dropBoxOAuth/core/oauth.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -95,7 +95,7 @@ export class DropboxOAuth extends BaseOAuth {
9595
): Promise<Response> {
9696
if (error) {
9797
const errorObj = typeof error === 'string' ? new OAuthError(error, 'CALLBACK_ERROR') : error;
98-
return this.createErrorResponse(errorObj);
98+
return this.createErrorResponse(errorObj, nonce);
9999
}
100100

101101
try {
@@ -116,7 +116,8 @@ export class DropboxOAuth extends BaseOAuth {
116116
error instanceof Error ? error.message : 'Failed to create callback page',
117117
'CALLBACK_ERROR',
118118
error
119-
)
119+
),
120+
nonce
120121
);
121122
}
122123
}

‎src/dropBoxOAuth/core/selection.ts‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -50,15 +50,16 @@ export class DropboxSelection extends BaseSelection {
5050

5151
// Generate the Dropbox file picker content
5252
const content = DropboxPicker.createPickerHTML(
53-
{
53+
{
5454
access_token: tokens.access_token,
5555
refresh_token: refreshToken,
5656
expires_in: tokens.expires_in,
5757
token_type: tokens.token_type
58-
},
59-
config,
60-
refreshToken,
61-
selectedFiles
58+
},
59+
config,
60+
refreshToken,
61+
selectedFiles,
62+
config.nonce
6263
);
6364

6465
// Write content to the popup

‎src/dropBoxOAuth/ui/picker.ts‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@ export class DropboxPicker extends BasePicker {
6868
script.id = 'dropboxjs';
6969
script.src = 'https://www.dropbox.com/static/api/2/dropins.js';
7070
script.setAttribute('data-app-key', '${config.appKey}');
71+
${nonce ? `script.setAttribute('nonce', '${nonce}');` : ''}
7172
script.onload = () => {
7273
if (isDropboxAvailable()) {
7374
resolve(true);

‎src/googleDriveOAuth/core/oauth.ts‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -100,7 +100,7 @@ export class GoogleDriveOAuth extends BaseOAuth {
100100
): Promise<Response> {
101101
if (error) {
102102
const errorObj = typeof error === 'string' ? new OAuthError(error, 'CALLBACK_ERROR') : error;
103-
return this.createErrorResponse(errorObj);
103+
return this.createErrorResponse(errorObj, nonce);
104104
}
105105

106106
try {
@@ -121,7 +121,8 @@ export class GoogleDriveOAuth extends BaseOAuth {
121121
error instanceof Error ? error.message : 'Failed to create callback page',
122122
'CALLBACK_ERROR',
123123
error
124-
)
124+
),
125+
nonce
125126
);
126127
}
127128
}

‎src/googleDriveOAuth/core/selection.ts‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -51,15 +51,16 @@ export class GoogleDriveSelection extends BaseSelection {
5151

5252
// Generate the Google Drive file picker content
5353
const content = GoogleDrivePicker.createPickerHTML(
54-
{
54+
{
5555
access_token: tokens.access_token,
5656
refresh_token: refreshToken,
5757
expires_in: tokens.expires_in,
5858
token_type: tokens.token_type
59-
},
60-
config,
61-
refreshToken,
62-
selectedFiles
59+
},
60+
config,
61+
refreshToken,
62+
selectedFiles,
63+
config.nonce
6364
);
6465

6566
// Write content to the popup

‎src/googleDriveOAuth/ui/picker.ts‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -140,8 +140,8 @@ export class GoogleDrivePicker extends BasePicker {
140140

141141
// Google-specific head includes
142142
const googleHead = `
143-
<script src="https://apis.google.com/js/api.js"></script>
144-
<script src="https://apis.google.com/js/platform.js"></script>
143+
<script src="https://apis.google.com/js/api.js"${nonce ? ` nonce="${nonce}"` : ''}></script>
144+
<script src="https://apis.google.com/js/platform.js"${nonce ? ` nonce="${nonce}"` : ''}></script>
145145
`;
146146

147147
// Assemble the complete HTML

0 commit comments

Comments
 (0)