Hardening + CSP correctness, SARIF output, Report-Only detection (1.2.0) - #6
Merged
Conversation
- publish.yml: add id-token:write permission and --provenance flag for npm provenance attestation - package.json: add conditional exports map (keep main/types for back-compat); run lint + test + build in prepublishOnly - ci.yml: add non-blocking npm audit --audit-level=high step - README: add npm/CI/license badges and a "How this differs from securityheaders.com" section Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Treat a directive of exactly 'none' as safe (blocks everything) instead of penalizing it as dangerous or missing. - Only reward frame-ancestors when it is a real allowlist / 'self' / 'none'; a wildcard or 'unsafe-inline' now earns no bonus and is flagged as weak. - Recognize 'nonce-...' and 'sha256/384/512-...' source expressions in script-src/style-src: credit them as a secure inline mechanism and stop penalizing the inert 'unsafe-inline' backwards-compat fallback beside them. - Fix a stray quote in the wildcard warning message. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add an analyzer that flags report-only mode, which monitors violations but does not enforce the policy. It emits a warning when report-only is the only CSP present, and a purely informational finding (never punishing) when a real enforcing Content-Security-Policy also exists. The check has maxScore 0 so it never moves the grade. Wired into the header registry and checker. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
- Add formatSarif() emitting valid SARIF 2.1.0 (one run, one rule per header check, results for failing/warning/noteworthy headers mapped to error/warning/note, plus information-disclosure notes). Register it in the formatters barrel and accept `--format sarif` in the CLI. - Add `sarif` to the OutputFormat type and CLI VALID_FORMATS / help / README. - Export detectWaf (and the WafDetection type) from the package entry point. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Add the missing Tier 2 test files for existing analyzers: - set-cookie: Secure/HttpOnly/SameSite present and absent, SameSite=None without Secure, and the localhost exemption. - cache-control: no-store, private/no-cache, private, public, and unclear. - coep: require-corp, credentialless, unsafe-none, missing, unexpected. - corp: same-origin, same-site, cross-origin, missing, unexpected. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Bump version and document the hardening + feature changes in this branch. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…p-fixes # Conflicts: # CHANGELOG.md
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Supply-chain/packaging hardening plus CSP-grading correctness fixes and two new features. Releases 1.2.0.
Tier 1 — hardening
id-token: write+--provenance)exportsmap (keepsmain/typesfor back-compat)prepublishOnlynow runslint && test && buildnpm audit --audit-level=highstep in CITier 2 — correctness
'none'is recognized as fully locked-down (never penalized)frame-ancestors */'unsafe-inline'no longer wrongly earn the clickjacking bonus'nonce-…','sha256|384|512-…') are credited and suppress the browser-ignored'unsafe-inline'penaltyTier 2 — features
Content-Security-Policy-Report-Onlyanalyzer (informational; warns when it is the only CSP)--format sariffor GitHub code-scanning / CI ingestiondetectWafnow exported from the entry pointTests
New coverage for set-cookie, cache-control, coep, corp, csp (none/frame-ancestors/nonce), csp-report-only, and SARIF. 119/119 passing,
tsc --noEmit+ build clean.🤖 Generated with Claude Code