search

Shazwazza / Smidge

A lightweight runtime CSS/JavaScript file minification, combination, compression & management library for ASP.Net Core
MIT License
365 stars 47 forks source link

Feature/protect file extensions #164

Closed markadrake closed 1 year ago

markadrake commented 2 years ago

Protect File Extensions

I deployed the Umbraco CMS to a secure enterprise environment and encountered an issue. Our security policies blocked the static asset bundles produced by Smidge. After troubleshooting, we discovered that network requests were being blocked because the file extensions were unknown. Smidge's file naming pattern changes the file extension.

With this PR, I hope to remedy the above issue by opting in through a configuration value protectFileExtensions.

Please review my PR and I appreciate any critical feedback. I am not a C# developer.

  1. Adds a new configuration option, protectFileExtensions.
  2. Requires opt-in, so no existing behavior should be modified.
  3. After opt-in, the naming scheme will preserve the file extension (.css or .js).
  4. Adds two additional tests for verifying the path URL when protectFileExtensions is set to true.

Sample Settings

image

Previously, without protectFileExtensions

image

Now, with protectFileExtensions

image
markadrake commented 2 years ago

@Shazwazza,

I ran into various errors after running Smidge.Web.

  1. The application failed to start because of a missing directory: ~/Smidge/Static.
  2. Startup.cs:197 adds a non-existent file to a bundle. The application handles this error and continues to run.

Please let me know if you would like me to check in the changes I made to remedy these issues. Respectively:

  1. Created the missing folder.
  2. Removed lines 197-200.
markadrake commented 1 year ago

Please note that protectFileExtensions has been renamed to keepFileExtensions.

appsettings.json:

image

Smidge.Tests:

image
markadrake commented 1 year ago

@Shazwazza or @PhyxionNL, I apologize for my persistence with this issue. Could either of you provide me some additional feedback, as I do have some time I can dedicate to working and addressing any problems or concerns? I do appreciate it. I appreciate your help,

All the best,

markadrake commented 1 year ago

@Shazwazza if there is any feedback at all, I'm happy to try and implement the changes. Hope all is good sir!

Shazwazza commented 1 year ago

Sorry for the delay, having a look now

Shazwazza commented 1 year ago

Looks awesome, thanks so much 🎉

I'll ship a release asap

Shazwazza commented 1 year ago

This has been pushed :) https://github.com/Shazwazza/Smidge/releases/tag/v4.2.0