slackhq / csp-html-webpack-plugin

A plugin which, when combined with HTMLWebpackPlugin, adds CSP tags to the HTML output.
MIT License
164 stars 40 forks source link

Not generating meta tag #36

Closed brymon68 closed 5 years ago

brymon68 commented 5 years ago

Description

I use an ejected CRA webpack.config.js. When adding your plugin and trying to generate a CSP meta tag, nothing is appended to HTML. Any idea how I can get this to work?

What type of issue is this? (place an x in one of the [ ])

Requirements (place an x in each of the [ ])


Bug Report

Filling out the following details about bugs will help us solve your issue sooner.

Reproducible in:

cra 2.0.0

node version: 8.6

OS version(s):

Steps to reproduce:

Here is my webpack.config.js snippet:

new HtmlWebpackPlugin(
        {
          cspPlugin: {
            enabled: true,
            policy: {
              'base-uri': "'self'",
              'object-src': "'none'",
              'script-src': ["'unsafe-inline'", "'self'", "'unsafe-eval'"],
              'style-src': ["'unsafe-inline'", "'self'", "'unsafe-eval'"]
            },
            hashEnabled: {
              'script-src': true,
              'style-src': true
            },
            nonceEnabled: {
              'script-src': true,
              'style-src': true
            }
          }
        },
        {
          inject: true,
          template: paths.appHtml,
        },
        isEnvProduction
          ? {
            minify: {
              removeComments: true,
              collapseWhitespace: true,
              removeRedundantAttributes: true,
              useShortDoctype: true,
              removeEmptyAttributes: true,
              removeStyleLinkTypeAttributes: true,
              keepClosingSlash: true,
              minifyJS: true,
              minifyCSS: true,
              minifyURLs: true,
            },
          }
          : undefined
      ),

      new CspHtmlWebpackPlugin({
        'base-uri': "'self'",
        'object-src': "'none'",
        'script-src': ["'unsafe-inline'", "'self'", "'unsafe-eval'"],
        'style-src': ["'unsafe-inline'", "'self'", "'unsafe-eval'"]
      }, {
          enabled: true,
          hashingMethod: 'sha256',
          hashEnabled: {
            'script-src': true,
            'style-src': true
          },
          nonceEnabled: {
            'script-src': true,
            'style-src': true
          }
        }),

Expected result:

tag appended to html

Actual result:

Nothing is appended

brymon68 commented 5 years ago

Edit: this can be closed

AndrewCraswell commented 3 years ago

@brymon68 I'm experiencing this issue as well. What was your solution?