diff --git a/src/app/api/csp-report/route.ts b/src/app/api/csp-report/route.ts index dd8832e..443446c 100644 --- a/src/app/api/csp-report/route.ts +++ b/src/app/api/csp-report/route.ts @@ -23,12 +23,19 @@ interface NormalizedViolation { blockedUri?: string; disposition?: string; sourceFile?: string; + lineNumber?: string; + columnNumber?: string; + sample?: string; } function asString(value: unknown): string | undefined { return typeof value === "string" ? value : undefined; } +function asStringified(value: unknown): string | undefined { + return typeof value === "number" ? String(value) : asString(value); +} + function normalizeReports(payload: unknown): NormalizedViolation[] { if (Array.isArray(payload)) { return payload @@ -41,6 +48,9 @@ function normalizeReports(payload: unknown): NormalizedViolation[] { blockedUri: asString(body.blockedURL), disposition: asString(body.disposition), sourceFile: asString(body.sourceFile), + lineNumber: asStringified(body.lineNumber), + columnNumber: asStringified(body.columnNumber), + sample: asString(body.sample), }; }); } @@ -54,6 +64,9 @@ function normalizeReports(payload: unknown): NormalizedViolation[] { blockedUri: asString(report["blocked-uri"]), disposition: asString(report.disposition), sourceFile: asString(report["source-file"]), + lineNumber: asStringified(report["line-number"]), + columnNumber: asStringified(report["column-number"]), + sample: asString(report["script-sample"]), }, ]; } diff --git a/src/proxy.ts b/src/proxy.ts index 797a826..67bf666 100644 --- a/src/proxy.ts +++ b/src/proxy.ts @@ -139,7 +139,7 @@ export default clerkMiddleware( reportOnly: false, reportTo: "/api/csp-report", directives: { - "script-src": ["unsafe-eval"], + "script-src": ["unsafe-eval", "'report-sample'"], "img-src": [`https://${getSupabaseHostname()}`, "https://image.mux.com", "blob:"], "connect-src": [ `https://${getSupabaseHostname()}`,