Merge pull request #18 from rifler/custom-processing

add processCspString param

Author: frux

packages/express-csp-header/README.md

@@ -79,6 +79,23 @@ app.use(expressCspHeader({
 // etc
 ```
 
+### Custom processing
+
+```js
+const { expressCspHeader } = require('express-csp-header');
+
+app.use(expressCspHeader({
+    directives: {
+        'default-src': ["#someString#"],
+        'script-src': ["#someOtherString#"],
+    },
+    processCspString: (cspString, req, res) => {
+        // here you can process final cspString
+        return cspString.replaceAll('#someString#', 'https://example.com').replaceAll('#someOtherString#', 'https://example2.com');
+    }
+}));
+```
+
 ## CSP violation report
 For more information read [csp-header documentation](https://github.com/frux/csp/tree/master/packages/csp-header#csp-violation-report). `express-csp-header` helps you manage both `Content-Security-Policy` and `Reporting-Endpoints` headers. [Report-to headers  is no longer recommended to use](https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Report-To)
 

packages/express-csp-header/src/index.ts

@@ -33,6 +33,7 @@ export interface ExpressCSPParams extends Omit<CSPHeaderParams, 'reportUri'> {
 	reportTo?: ReportTo[] | ReportToFunction,
 	reportUri?: string | ReportUriFunction,
 	reportingEndpoints?: ReportingEndpoint[] | ((req: Request, res: Response) => ReportingEndpoint[]),
+	processCspString?: (cspString: string, req: Request, res: Response) => string;
 }
 
 export function expressCspHeader(params?: ExpressCSPParams): RequestHandler {
@@ -46,6 +47,7 @@ export function expressCspHeader(params?: ExpressCSPParams): RequestHandler {
 		let cspString = getCspString(req, res, params);
 		cspString = applyNonce(req ,res, cspString);
 		cspString = applyAutoTld(req, cspString, domainOptions);
+		cspString = params.processCspString ? params.processCspString(cspString, req, res) : cspString;
 
 		res.set(params.reportOnly ? CSP_REPORT_ONLY_HEADER : CSP_HEADER, cspString);
 

packages/express-csp-header/tests/index.test.ts

@@ -308,3 +308,19 @@ describe('Reporting-Endpoints', () => {
 		);
 	});
 });
+
+describe('processCspString', () => {
+	test('should process CSP string', () => {
+		const { res } = execMiddleware({
+			directives: {
+				'default-src': ["#someString#"],
+				'script-src': ["#someOtherString#"],
+			},
+			processCspString: (cspString, req, res) => {
+				return cspString.replaceAll('#someString#', 'https://example.com').replaceAll('#someOtherString#', 'https://example2.com');
+			}
+		});
+
+		expect(res.headers['Content-Security-Policy']).toStrictEqual("default-src https://example.com; script-src https://example2.com;");
+	});
+});