Release/v3.1.0 (#183)

Added CMS13 Support
Fix #165

Author: andrewmarkham

.github/workflows/build-jhoose-security-cms13.yml

@@ -0,0 +1,70 @@
+name: Jhoose Security - CMS13 Build
+
+on:
+  push:
+    branches: [ main, release/* ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+env:
+  BUILD_NO: 3.1.0.${{ github.run_number }}  
+  BUILD_NO_PRE: 3.1.0-rc.${{ github.run_number }} 
+
+jobs:
+  build:
+    
+    runs-on: ubuntu-latest
+    
+    steps:
+    - uses: actions/checkout@v6
+
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v5
+      with:
+        dotnet-version: | 
+          10.0.x
+
+    - name: Configure Source
+      working-directory: ./src/Jhoose.Security
+      run: dotnet nuget add source https://nuget.pkg.github.com/andrewmarkham/index.json --name "GithubBuild" --store-password-in-clear-text --username andrewmarkham --password ${{ secrets.PACKAGE_TOKEN }}
+
+    - name: Use Node.js 22.21.0
+      uses: actions/setup-node@v5
+      with:
+        node-version: 22.21.0
+
+    - name: Run node
+      working-directory: ./src/Jhoose.Security/src
+      run: |
+       npm install 
+       npm run publish
+
+    - name: Build (Production)
+      if: github.ref == 'refs/heads/main'
+      run: dotnet build --configuration Release -p:Version=${{ env.BUILD_NO }} -p:CMSVersion=CMS13
+      working-directory: ./src/Jhoose.Security
+
+    - name: Build (Pre Release)
+      if: github.ref != 'refs/heads/main'
+      run: dotnet build --configuration PreRelease -p:Version=${{ env.BUILD_NO_PRE }} -p:CMSVersion=CMS13
+      working-directory: ./src/Jhoose.Security
+
+    - name: Run Jhoose.Security.Tests
+      working-directory: ./src/Tests/Jhoose.Security.Tests
+      run: dotnet test Jhoose.Security.Tests.csproj --configuration Release --logger "trx;LogFileName=test_results.trx"
+
+    - name: Report tests
+      if: always()
+      uses: dorny/test-reporter@v3
+      with:
+        name: NUnit Tests
+        path: './src/**/test_results.trx'
+        reporter: dotnet-trx
+
+    - name: nuget push
+      if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release')
+      working-directory: ./src/Jhoose.Security
+      run: dotnet nuget push "**/Jhoose.Security*.nupkg" -k ${{ env.GITHUB_TOKEN }} -s https://nuget.pkg.github.com/andrewmarkham/index.json --skip-duplicate
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/build-jhoose-security-core.yml

@@ -1,4 +1,4 @@
-name: Jhoose Security
+name: Jhoose Security CMS12
 
 on:
   push:
@@ -8,19 +8,19 @@ on:
   workflow_dispatch:
 
 env:
-  BUILD_NO: 3.0.4.${{ github.run_number }}  
-  BUILD_NO_PRE: 3.0.4-rc.${{ github.run_number }} 
+  BUILD_NO: 3.1.0.${{ github.run_number }}  
+  BUILD_NO_PRE: 3.1.0-rc.${{ github.run_number }} 
 
 jobs:
   build:
 
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@v6
 
     - name: Setup .NET
-      uses: actions/setup-dotnet@v4
+      uses: actions/setup-dotnet@v5
       with:
         dotnet-version: | 
           8.0.x
@@ -32,7 +32,7 @@ jobs:
       run: dotnet nuget add source https://nuget.pkg.github.com/andrewmarkham/index.json --name "GithubBuild" --store-password-in-clear-text --username andrewmarkham --password ${{ secrets.PACKAGE_TOKEN }}
 
     - name: Use Node.js 22.21.0
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@v5
       with:
         node-version: 22.21.0
 
@@ -58,7 +58,7 @@ jobs:
 
     - name: Report tests
       if: always()
-      uses: dorny/test-reporter@v1
+      uses: dorny/test-reporter@v3
       with:
         name: NUnit Tests
         path: './src/**/test_results.trx'

.github/workflows/build-jhoose-security.yml

@@ -10071,3 +10071,5 @@ src/Jhoose.Security/src/node_modules/@antv/g6-extension-react/src/react-node/ren
 src/Tests/PerformanceBenchMarks/bin/Release/net8.0/Jhoose.Security.dll
 src/Tests/PerformanceBenchMarks/bin/Release/net8.0/Jhoose.Security.pdb
 src/Tests/PerformanceBenchMarks/bin/Release/net8.0/Jhoose.Security.xml
+src/Sample/Foundation/modules/_protected/Jhoose.Security/ClientResources/csp-app.js
+src/Sample/Foundation/modules/_protected/Jhoose.Security/module.config

.gitignore

@@ -43,6 +43,26 @@
             "sourceFileMap": {
                 "/Views": "${workspaceFolder}/src/Sample/Foundation/Views"
             }
+        },
+        {
+            "name": "CMS13",
+            "type": "coreclr",
+            "request": "launch",
+            "preLaunchTask": "buildCMS13",
+            "program": "${workspaceFolder}/src/Sample/CMS13/bin/Debug/net10.0/alloy13preview.dll",
+            "args": [],
+            "cwd": "${workspaceFolder}/src/Sample/CMS13",
+            "stopAtEntry": false,
+            "serverReadyAction": {
+                "action": "openExternally",
+                "pattern": "\\bNow listening on:\\s+(https?://\\S+)"
+            },
+            "env": {
+                "ASPNETCORE_ENVIRONMENT": "Development"
+            },
+            "sourceFileMap": {
+                "/Views": "${workspaceFolder}/src/Sample/CMS13/Views"
+            }
         }
     ]
 }

.vscode/launch.json

@@ -43,6 +43,19 @@
             ],
             "problemMatcher": "$msCompile"
         },
+    {
+            "label": "buildCMS13",
+            "command": "dotnet",
+            "type": "process",
+            "args": [
+                "build",
+                "${workspaceFolder}/src/Sample/CMS13/alloy13preview.csproj",
+                "/property:GenerateFullPaths=true",
+                "/property:CMSVersion=CMS13",
+                "/consoleloggerparameters:NoSummary"
+            ],
+            "problemMatcher": "$msCompile"
+        },
         {
             "label": "copy",
             "command": "cp",

.vscode/tasks.json

@@ -7,6 +7,7 @@ This module adds several security features to an Optimizely website.
  - User interface to manage the Recommended Security headers and add to the response headers.
 
  This module fully supports
+  - Optimizely 13, .NET (10.0) (From version 3.1.0)
   - Optimizely 12, .NET (6.0-8.0) (Up to version 2.5.0)
   - Optimizely 12, .NET (8.0-10.0) (From version 2.6.0)
   - Episerver 11, .Net Framework 4.7.1 and Optimizely 12, .NET 5.0 [Legacy Documentation](./documentation/Legacy%20README.md)
@@ -18,12 +19,20 @@ This module adds several security features to an Optimizely website.
 
 Install the package directly from the Optimizely NuGet repository.  
 
-``` 
+``` bash
+# To install CMS12
 dotnet add package Jhoose.Security.Admin
-```
 
+# To install CMS13
+dotnet add package Jhoose.Security.Admin13
 ```
+
+``` bash
+# To install CMS12
 Install-Package Jhoose.Security.Admin
+
+# To install CMS13
+Install-Package Jhoose.Security.Admin13
 ```
 
 ### Upgrade to V3.0.0
@@ -296,4 +305,5 @@ X-API-Key: ...
  |2.6.2|Fixed another bug with (CRLF in header values)|
  |2.6.3|Fixed performance issues with the reporting API.<br/>Fixed a race condition that caused the nonce to leak across requests under high load.|
  |3.0.0|Added multisite support, CSP and Permissions Policy, Security Headers can now be configured per site.  |
- |3.0.2|Fixed issue with the files not being copied to the output directory when building the project, this was causing the module to not work when installed from NuGet.|
+ |3.0.4|Fixed issue with the files not being copied to the output directory when building the project, this was causing the module to not work when installed from NuGet.|
+ |3.1.0| Added CMS13 Support.|

README.md

@@ -3,7 +3,7 @@
 using System.Linq;
 
 using EPiServer.Authorization;
-using EPiServer.ServiceLocation;
+
 using EPiServer.Shell.Modules;
 using Jhoose.Security.Configuration;
 
@@ -41,6 +41,12 @@
 using Jhoose.Security.Features.CSP.Repository;
 using Jhoose.Security.Features.Core.Providers;
 
+
+#if CMS12
+    using EPiServer.ServiceLocation;
+#else
+    using EPiServer.DependencyInjection;
+#endif
 namespace Jhoose.Security.DependencyInjection;
 
 public static class SecurityExtensions
@@ -151,6 +157,7 @@ public static IServiceCollection AddJhooseSecurity(this IServiceCollection servi
 
     public static IApplicationBuilder UseJhooseSecurity(this IApplicationBuilder applicationBuilder)
     {
+        
         var securityOptions = applicationBuilder.ApplicationServices.GetService<IOptions<JhooseSecurityOptions>>();
 
         applicationBuilder = applicationBuilder.UseWhen(c => IsValidPath(c.Request, securityOptions?.Value.ExclusionPaths ?? Enumerable.Empty<string>()), ab =>
@@ -172,7 +179,6 @@ public static IApplicationBuilder UseJhooseSecurity(this IApplicationBuilder app
 
     public static bool IsValidPath(HttpRequest request, IEnumerable<string> exclusionPaths)
     {
-
         foreach (var path in exclusionPaths)
         {
             if (request.Path.StartsWithSegments(path, System.StringComparison.InvariantCultureIgnoreCase))
@@ -183,4 +189,4 @@ public static bool IsValidPath(HttpRequest request, IEnumerable<string> exclusio
 
         return true;
     }
-}
+}

src/Jhoose.Security/DependencyInjection/SecurityExtensions.cs

@@ -35,14 +35,21 @@ public virtual List<T> Load(string headerName)
 
         var headerList = new List<T>();
 
-        foreach (var header in headers)
-        {
-            var responseHeader = JsonSerializer.Deserialize<T>(header.Value);
-            if (responseHeader != null)
+        try {
+            foreach (var header in headers)
             {
-                headerList.Add(responseHeader);
+                var responseHeader = JsonSerializer.Deserialize<T>(header.Value);
+                if (responseHeader != null)
+                {
+                    headerList.Add(responseHeader);
+                }
             }
         }
+        catch (JsonException ex)
+        {
+            logger.LogError(ex, "Error deserializing response header from database");
+        }
+
         return headerList;
     }
 

src/Jhoose.Security/Features/Core/SecurityRepositoryBase.cs

@@ -1,9 +1,13 @@
 using System;
-
+using System.Collections.Generic;
 using System.Linq;
 using System.Text;
 using System.Threading.Tasks;
 
+using EPiServer.Formatters;
+
+using Jhoose.Security.Features.Reporting.Models;
+
 using Microsoft.AspNetCore.Mvc.Formatters;
 using Microsoft.Extensions.DependencyInjection;
 using Microsoft.Extensions.Logging;
@@ -12,16 +16,17 @@
 
 namespace Jhoose.Security.Features.Reporting.Controllers;
 
-public class ProblemJsonFormatter : TextInputFormatter
+public class ProblemJsonFormatter : TextInputFormatter, IJsonInputFormatter
 {
+
     public ProblemJsonFormatter()
     {
-
         this.SupportedMediaTypes.Add(new Microsoft.Net.Http.Headers.MediaTypeHeaderValue("application/problem+json"));
         this.SupportedMediaTypes.Add(new Microsoft.Net.Http.Headers.MediaTypeHeaderValue("application/reports+json"));
         this.SupportedMediaTypes.Add(new Microsoft.Net.Http.Headers.MediaTypeHeaderValue("application/csp-report"));
         this.SupportedEncodings.Add(Encoding.UTF8);
         this.SupportedEncodings.Add(Encoding.Unicode);
+
     }
 
     public override async Task<InputFormatterResult> ReadRequestBodyAsync(InputFormatterContext context, Encoding effectiveEncoding)
@@ -52,4 +57,4 @@ public override async Task<InputFormatterResult> ReadRequestBodyAsync(InputForma
             return await InputFormatterResult.FailureAsync();
         }
     }
-}
+}