2016-10-06 01:52:50 +02:00
|
|
|
{
|
2018-10-01 01:02:10 +02:00
|
|
|
"name": "nextjs-project",
|
2021-09-21 19:17:16 +02:00
|
|
|
"version": "0.0.0",
|
2018-10-01 01:02:10 +02:00
|
|
|
"private": true,
|
|
|
|
|
"workspaces": [
|
|
|
|
|
"packages/*"
|
2016-10-06 01:52:50 +02:00
|
|
|
],
|
|
|
|
|
"scripts": {
|
2022-01-06 16:45:04 +01:00
|
|
|
"new-error": "plop error",
|
|
|
|
|
"new-test": "plop test",
|
2022-05-29 06:35:16 +02:00
|
|
|
"clean": "pnpm lerna clean -y && pnpm lerna bootstrap && pnpm lerna exec 'rm -rf ./dist'",
|
2022-05-31 02:05:27 +02:00
|
|
|
"build": "turbo run build",
|
2018-10-01 01:02:10 +02:00
|
|
|
"lerna": "lerna",
|
2021-02-03 18:02:44 +01:00
|
|
|
"dev": "lerna run dev --stream --parallel",
|
2022-05-29 06:35:16 +02:00
|
|
|
"test-types": "pnpm tsc",
|
|
|
|
|
"test-unit": "pnpm jest test/unit/",
|
|
|
|
|
"test-dev": "cross-env NEXT_TEST_MODE=dev pnpm testheadless",
|
|
|
|
|
"test-start": "cross-env NEXT_TEST_MODE=start pnpm testheadless",
|
|
|
|
|
"test-deploy": "cross-env NEXT_TEST_MODE=deploy pnpm testheadless",
|
|
|
|
|
"testonly": "pnpm jest --runInBand",
|
|
|
|
|
"testheadless": "cross-env HEADLESS=true pnpm testonly",
|
2020-05-21 14:07:27 +02:00
|
|
|
"genstats": "cross-env LOCAL_STATS=true node .github/actions/next-stats-action/src/index.js",
|
2019-03-17 17:43:03 +01:00
|
|
|
"git-reset": "git reset --hard HEAD",
|
|
|
|
|
"git-clean": "git clean -d -x -e node_modules -e packages -f",
|
2019-11-27 20:26:40 +01:00
|
|
|
"lint-typescript": "lerna run typescript",
|
2021-08-25 19:33:57 +02:00
|
|
|
"lint-eslint": "eslint . --ext js,jsx,ts,tsx --max-warnings=0 --config .eslintrc.json --no-eslintrc",
|
2021-01-11 20:24:17 +01:00
|
|
|
"lint-no-typescript": "run-p prettier-check lint-eslint",
|
2021-08-24 14:52:45 +02:00
|
|
|
"lint": "run-p test-types lint-typescript prettier-check lint-eslint lint-language",
|
2022-05-29 06:35:16 +02:00
|
|
|
"lint-fix": "pnpm prettier-fix && eslint . --ext js,jsx,ts,tsx --fix --max-warnings=0 --config .eslintrc.json --no-eslintrc",
|
2021-06-22 18:03:12 +02:00
|
|
|
"lint-language": "alex .",
|
2020-09-14 04:53:19 +02:00
|
|
|
"prettier-check": "prettier --check .",
|
|
|
|
|
"prettier-fix": "prettier --write .",
|
2019-07-11 02:59:53 +02:00
|
|
|
"types": "lerna run types --stream",
|
2022-05-31 02:05:27 +02:00
|
|
|
"typescript": "turbo run typescript",
|
|
|
|
|
"prepublishOnly": "turbo run build",
|
2021-07-02 00:19:14 +02:00
|
|
|
"publish-canary": "git checkout canary && git pull && lerna version prerelease --preid canary --force-publish && release --pre --skip-questions",
|
2019-02-11 08:44:28 +01:00
|
|
|
"publish-stable": "lerna version --force-publish",
|
2019-04-09 17:52:03 +02:00
|
|
|
"lint-staged": "lint-staged",
|
2021-07-01 13:41:27 +02:00
|
|
|
"next-with-deps": "./scripts/next-with-deps.sh",
|
2021-05-28 14:48:32 +02:00
|
|
|
"next": "node --trace-deprecation --enable-source-maps packages/next/dist/bin/next",
|
2022-04-05 23:51:47 +02:00
|
|
|
"next-react-17": "node --trace-deprecation --enable-source-maps -r ./test/lib/react-17-require-hook.js packages/next/dist/bin/next",
|
2021-09-02 08:45:35 +02:00
|
|
|
"next-no-sourcemaps": "node --trace-deprecation packages/next/dist/bin/next",
|
2021-08-17 09:18:47 +02:00
|
|
|
"clean-trace-jaeger": "rm -rf test/integration/basic/.next && TRACE_TARGET=JAEGER node --trace-deprecation --enable-source-maps packages/next/dist/bin/next build test/integration/basic",
|
2021-11-03 00:37:25 +01:00
|
|
|
"debug": "node --inspect packages/next/dist/bin/next",
|
2022-05-29 21:59:38 +02:00
|
|
|
"postinstall": "git config feature.manyFiles true && node scripts/install-native.mjs",
|
|
|
|
|
"version": "pnpm install && git add pnpm-lock.yaml"
|
2016-10-06 01:52:50 +02:00
|
|
|
},
|
2018-10-10 11:58:44 +02:00
|
|
|
"pre-commit": "lint-staged",
|
2018-10-01 01:02:10 +02:00
|
|
|
"devDependencies": {
|
2022-05-31 03:00:12 +02:00
|
|
|
"@babel/core": "7.18.0",
|
|
|
|
|
"@babel/eslint-parser": "7.18.2",
|
|
|
|
|
"@babel/generator": "7.18.0",
|
2022-06-02 15:09:21 +02:00
|
|
|
"@babel/parser": "7.12.11",
|
2021-08-17 09:18:08 +02:00
|
|
|
"@babel/plugin-proposal-object-rest-spread": "7.14.7",
|
|
|
|
|
"@babel/preset-flow": "7.14.5",
|
|
|
|
|
"@babel/preset-react": "7.14.5",
|
2022-06-17 17:06:30 +02:00
|
|
|
"@edge-runtime/jest-environment": "1.1.0-beta.6",
|
2019-12-12 00:54:40 +01:00
|
|
|
"@fullhuman/postcss-purgecss": "1.3.0",
|
2019-03-04 18:02:45 +01:00
|
|
|
"@mdx-js/loader": "0.18.0",
|
2022-05-29 06:35:16 +02:00
|
|
|
"@next/bundle-analyzer": "workspace:*",
|
|
|
|
|
"@next/env": "workspace:*",
|
|
|
|
|
"@next/eslint-plugin-next": "workspace:*",
|
|
|
|
|
"@next/mdx": "workspace:*",
|
|
|
|
|
"@next/plugin-storybook": "workspace:*",
|
|
|
|
|
"@next/polyfill-module": "workspace:*",
|
|
|
|
|
"@next/polyfill-nomodule": "workspace:*",
|
|
|
|
|
"@next/swc": "workspace:*",
|
2021-06-18 02:40:22 +02:00
|
|
|
"@svgr/webpack": "5.5.0",
|
2022-03-05 22:45:30 +01:00
|
|
|
"@swc/cli": "0.1.55",
|
2022-06-21 17:51:47 +02:00
|
|
|
"@swc/core": "1.2.203",
|
|
|
|
|
"@swc/helpers": "0.4.2",
|
2022-04-05 23:51:47 +02:00
|
|
|
"@testing-library/react": "13.0.0",
|
2020-02-12 02:16:42 +01:00
|
|
|
"@types/cheerio": "0.22.16",
|
2020-04-19 19:58:31 +02:00
|
|
|
"@types/fs-extra": "8.1.0",
|
2022-02-01 01:13:46 +01:00
|
|
|
"@types/html-validator": "5.0.2",
|
2020-02-04 20:08:03 +01:00
|
|
|
"@types/http-proxy": "1.17.3",
|
2019-05-23 09:52:36 +02:00
|
|
|
"@types/jest": "24.0.13",
|
2022-01-04 16:35:32 +01:00
|
|
|
"@types/node": "13.11.0",
|
2022-05-29 06:35:16 +02:00
|
|
|
"@types/react": "16.9.17",
|
|
|
|
|
"@types/react-dom": "16.9.4",
|
2022-02-01 19:18:55 +01:00
|
|
|
"@types/relay-runtime": "13.0.0",
|
2021-09-13 14:36:25 +02:00
|
|
|
"@types/selenium-webdriver": "4.0.15",
|
2021-11-17 21:31:16 +01:00
|
|
|
"@types/sharp": "0.29.3",
|
2019-04-02 16:09:34 +02:00
|
|
|
"@types/string-hash": "1.1.1",
|
Route Loader Trusted Types Violation Fix (#34730)
Linked to issue #32209.
## Feature
- [ ] Implements an existing feature request or RFC. Make sure the feature request has been accepted for implementation before opening a PR.
- [x] Related issues linked using `fixes #number`
- [ ] Integration tests added
- [ ] Documentation added
- [ ] Telemetry added. In case of a feature if it's used or not.
- [ ] Errors have helpful link attached, see `contributing.md`
## Documentation
There is one tsec violation that is fixed in this PR:
### 1. ban-script-src-assignment: route-loader.ts
XSS can occur with the line script.src = src in appendScript(src, script) if src can be controlled by a malicious user. From tracing through the code, it was determined that src comes from the function `getFilesForRoute(route)`. The behaviour of this function differs depending on the environment (development vs. production), but in both cases the function will construct strings that lead to valid file paths. These strings depend on two variables: `assetPrefix` and `route`, but due to the nature of the constructed strings it was determined that the scripts here are safe to use. Thus, the solution was to promote these strings to `TrustedScriptURL`s. This is the Trusted Types way of declaring that the script URL passed to the DOM sink is safe from DOM XSS attacks.
To create a `TrustedScriptURL`, a policy needs to be created. This policy was put in its own file: `client/trusted-types.ts`. This policy has the name `nextjs`. If this name should be changed to something else, feel free to change it now. However, once it is released to the public and application developers begin using it, it may be harder to change the value since any application developers with a custom policy name allowlist would now need to update their `next.config.js` headers to allow this new name.
The code was tested in a sample application to ensure it behaved as expected.
2022-05-04 01:22:08 +02:00
|
|
|
"@types/trusted-types": "2.0.2",
|
2021-08-17 09:18:08 +02:00
|
|
|
"@typescript-eslint/eslint-plugin": "4.29.1",
|
|
|
|
|
"@typescript-eslint/parser": "4.29.1",
|
2021-08-06 17:20:05 +02:00
|
|
|
"@vercel/fetch": "6.1.1",
|
2021-09-21 19:17:16 +02:00
|
|
|
"@webassemblyjs/ast": "1.11.1",
|
|
|
|
|
"@webassemblyjs/floating-point-hex-parser": "1.11.1",
|
|
|
|
|
"@webassemblyjs/helper-api-error": "1.11.1",
|
|
|
|
|
"@webassemblyjs/helper-buffer": "1.11.1",
|
|
|
|
|
"@webassemblyjs/helper-code-frame": "npm:empty-npm-package@1.0.0",
|
|
|
|
|
"@webassemblyjs/helper-module-context": "npm:empty-npm-package@1.0.0",
|
|
|
|
|
"@webassemblyjs/helper-numbers": "1.11.1",
|
|
|
|
|
"@webassemblyjs/helper-wasm-bytecode": "1.11.1",
|
|
|
|
|
"@webassemblyjs/helper-wasm-section": "1.11.1",
|
|
|
|
|
"@webassemblyjs/ieee754": "1.11.1",
|
|
|
|
|
"@webassemblyjs/leb128": "1.11.1",
|
|
|
|
|
"@webassemblyjs/utf8": "1.11.1",
|
|
|
|
|
"@webassemblyjs/wasm-edit": "1.11.1",
|
|
|
|
|
"@webassemblyjs/wasm-gen": "1.11.1",
|
|
|
|
|
"@webassemblyjs/wasm-opt": "1.11.1",
|
|
|
|
|
"@webassemblyjs/wasm-parser": "1.11.1",
|
|
|
|
|
"@webassemblyjs/wast-parser": "npm:empty-npm-package@1.0.0",
|
|
|
|
|
"@webassemblyjs/wast-printer": "1.11.1",
|
2018-11-20 15:54:28 +01:00
|
|
|
"@zeit/next-typescript": "1.1.2-canary.0",
|
2019-05-23 09:52:36 +02:00
|
|
|
"abort-controller": "3.0.0",
|
2021-06-22 18:03:12 +02:00
|
|
|
"alex": "9.1.0",
|
2022-02-04 03:33:38 +01:00
|
|
|
"amphtml-validator": "1.0.35",
|
2019-09-10 19:11:55 +02:00
|
|
|
"async-sema": "3.0.1",
|
2022-04-22 13:14:29 +02:00
|
|
|
"browserslist": "4.20.2",
|
2017-02-16 23:53:39 +01:00
|
|
|
"cheerio": "0.22.0",
|
2020-05-11 02:48:57 +02:00
|
|
|
"cookie": "0.4.1",
|
2020-05-16 23:15:12 +02:00
|
|
|
"cors": "2.8.5",
|
2019-05-23 09:52:36 +02:00
|
|
|
"coveralls": "3.0.3",
|
2022-05-29 06:35:16 +02:00
|
|
|
"create-next-app": "workspace:*",
|
2020-12-01 19:02:07 +01:00
|
|
|
"critters": "0.0.6",
|
2019-12-26 21:01:22 +01:00
|
|
|
"cross-env": "6.0.3",
|
2019-02-26 21:57:32 +01:00
|
|
|
"cross-spawn": "6.0.5",
|
2022-03-08 17:15:09 +01:00
|
|
|
"dd-trace": "2.3.0",
|
2022-01-02 23:16:17 +01:00
|
|
|
"es5-ext": "0.10.53",
|
2019-11-25 22:52:29 +01:00
|
|
|
"escape-string-regexp": "2.0.0",
|
2021-04-25 20:34:36 +02:00
|
|
|
"eslint": "7.24.0",
|
2022-05-29 21:59:38 +02:00
|
|
|
"eslint-config-next": "workspace:*",
|
2021-04-25 20:34:36 +02:00
|
|
|
"eslint-plugin-import": "2.22.1",
|
|
|
|
|
"eslint-plugin-jest": "24.3.5",
|
|
|
|
|
"eslint-plugin-react": "7.23.2",
|
|
|
|
|
"eslint-plugin-react-hooks": "4.2.0",
|
2019-07-17 22:53:56 +02:00
|
|
|
"execa": "2.0.3",
|
2019-05-23 09:52:36 +02:00
|
|
|
"express": "4.17.0",
|
2021-06-18 19:12:20 +02:00
|
|
|
"faker": "5.5.3",
|
2019-07-11 19:02:43 +02:00
|
|
|
"faunadb": "2.6.1",
|
2020-05-29 01:23:35 +02:00
|
|
|
"firebase": "7.14.5",
|
2022-03-08 17:15:09 +01:00
|
|
|
"flat": "5.0.2",
|
2020-03-21 17:02:05 +01:00
|
|
|
"fs-extra": "9.0.0",
|
2020-05-11 02:48:57 +02:00
|
|
|
"get-port": "5.1.1",
|
2020-05-21 14:07:27 +02:00
|
|
|
"glob": "7.1.6",
|
|
|
|
|
"gzip-size": "5.1.1",
|
2022-02-01 01:13:46 +01:00
|
|
|
"html-validator": "5.1.18",
|
2021-02-18 11:23:24 +01:00
|
|
|
"image-size": "0.9.3",
|
2022-03-07 21:29:11 +01:00
|
|
|
"is-animated": "2.0.2",
|
2018-12-04 10:59:12 +01:00
|
|
|
"isomorphic-unfetch": "3.0.0",
|
2021-08-23 20:36:56 +02:00
|
|
|
"jest": "27.0.6",
|
2020-05-12 21:58:21 +02:00
|
|
|
"ky": "0.19.1",
|
|
|
|
|
"ky-universal": "0.6.0",
|
2021-02-12 13:34:25 +01:00
|
|
|
"lerna": "4.0.0",
|
2020-05-02 21:47:16 +02:00
|
|
|
"lint-staged": "10.1.7",
|
2020-05-15 23:15:15 +02:00
|
|
|
"lost": "8.3.1",
|
2020-05-21 14:07:27 +02:00
|
|
|
"minimatch": "3.0.4",
|
2019-08-20 21:19:45 +02:00
|
|
|
"moment": "^2.24.0",
|
2022-05-29 06:35:16 +02:00
|
|
|
"nanoid": "3.1.30",
|
2022-05-29 21:59:38 +02:00
|
|
|
"next": "workspace:*",
|
2022-01-19 17:48:11 +01:00
|
|
|
"node-fetch": "2.6.7",
|
2021-11-02 11:05:26 +01:00
|
|
|
"node-notifier": "8.0.1",
|
2021-09-09 11:00:19 +02:00
|
|
|
"node-sass": "6.0.1",
|
2019-11-27 20:26:40 +01:00
|
|
|
"npm-run-all": "4.1.5",
|
2019-12-12 16:51:38 +01:00
|
|
|
"nprogress": "0.2.0",
|
2019-12-11 17:51:10 +01:00
|
|
|
"pixrem": "5.0.0",
|
2022-06-07 06:37:01 +02:00
|
|
|
"playwright-chromium": "1.22.2",
|
2022-01-06 16:45:04 +01:00
|
|
|
"plop": "3.0.5",
|
2020-05-15 23:15:15 +02:00
|
|
|
"postcss-nested": "4.2.1",
|
2019-12-11 17:51:10 +01:00
|
|
|
"postcss-pseudoelements": "5.0.0",
|
2019-11-25 22:52:29 +01:00
|
|
|
"postcss-short-size": "4.0.0",
|
|
|
|
|
"postcss-trolling": "0.1.7",
|
2018-10-10 11:58:44 +02:00
|
|
|
"pre-commit": "1.2.2",
|
2022-03-06 21:41:22 +01:00
|
|
|
"prettier": "2.5.1",
|
2020-05-21 14:07:27 +02:00
|
|
|
"pretty-bytes": "5.3.0",
|
|
|
|
|
"pretty-ms": "7.0.0",
|
2021-09-13 15:49:29 +02:00
|
|
|
"random-seed": "0.3.0",
|
2022-06-15 17:14:43 +02:00
|
|
|
"react": "18.2.0",
|
2022-04-05 23:51:47 +02:00
|
|
|
"react-17": "npm:react@17.0.2",
|
2022-06-15 17:14:43 +02:00
|
|
|
"react-dom": "18.2.0",
|
2022-04-05 23:51:47 +02:00
|
|
|
"react-dom-17": "npm:react-dom@17.0.2",
|
2020-01-04 17:40:18 +01:00
|
|
|
"react-ssr-prepass": "1.0.8",
|
2022-03-05 22:45:30 +01:00
|
|
|
"react-virtualized": "9.22.3",
|
2022-02-01 19:18:55 +01:00
|
|
|
"relay-compiler": "13.0.2",
|
|
|
|
|
"relay-runtime": "13.0.2",
|
2022-06-24 22:02:40 +02:00
|
|
|
"release": "6.3.1",
|
2019-05-23 09:52:36 +02:00
|
|
|
"request-promise-core": "1.1.2",
|
2021-09-13 14:36:25 +02:00
|
|
|
"resolve-from": "5.0.0",
|
2020-08-21 20:50:24 +02:00
|
|
|
"seedrandom": "3.0.5",
|
2021-09-13 14:36:25 +02:00
|
|
|
"selenium-webdriver": "4.0.0-beta.4",
|
2022-05-29 06:35:16 +02:00
|
|
|
"semver": "7.3.7",
|
2021-10-29 18:12:46 +02:00
|
|
|
"shell-quote": "1.7.3",
|
2021-11-09 11:05:31 +01:00
|
|
|
"styled-components": "5.3.3",
|
2020-11-06 03:33:14 +01:00
|
|
|
"styled-jsx-plugin-postcss": "3.0.2",
|
2019-11-25 22:52:29 +01:00
|
|
|
"tailwindcss": "1.1.3",
|
2017-09-27 20:11:02 +02:00
|
|
|
"taskr": "1.1.0",
|
2020-10-23 09:52:37 +02:00
|
|
|
"tree-kill": "1.2.2",
|
2022-02-25 01:59:18 +01:00
|
|
|
"tsec": "0.2.1",
|
2022-06-24 16:31:26 +02:00
|
|
|
"turbo": "1.3.1",
|
2022-04-15 19:09:12 +02:00
|
|
|
"typescript": "4.6.3",
|
2018-10-12 15:32:17 +02:00
|
|
|
"wait-port": "0.2.2",
|
2022-06-02 15:09:21 +02:00
|
|
|
"webpack": "link:node_modules/webpack5",
|
2020-12-18 09:47:26 +01:00
|
|
|
"webpack-bundle-analyzer": "4.3.0",
|
2021-07-20 13:53:48 +02:00
|
|
|
"worker-loader": "3.0.7"
|
2018-11-03 17:42:43 +01:00
|
|
|
},
|
2019-10-23 03:02:59 +02:00
|
|
|
"resolutions": {
|
2022-04-22 13:14:29 +02:00
|
|
|
"browserslist": "4.20.2",
|
2022-05-29 06:35:16 +02:00
|
|
|
"caniuse-lite": "1.0.30001332",
|
2022-05-31 03:00:12 +02:00
|
|
|
"@babel/core": "7.18.0",
|
|
|
|
|
"@babel/parser": "7.18.0",
|
|
|
|
|
"@babel/types": "7.18.0",
|
|
|
|
|
"@babel/traverse": "7.18.0"
|
2019-10-23 03:02:59 +02:00
|
|
|
},
|
2018-11-03 17:42:43 +01:00
|
|
|
"engines": {
|
2022-05-30 15:13:36 +02:00
|
|
|
"node": ">=12.22.0",
|
2022-06-17 19:36:37 +02:00
|
|
|
"pnpm": ">= 7.2.1"
|
|
|
|
|
},
|
2022-06-23 18:55:05 +02:00
|
|
|
"packageManager": "pnpm@7.3.0"
|
2016-10-06 01:52:50 +02:00
|
|
|
}
|
