Variet/gravity_control
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(bridge): CSP script-src 'unsafe-inline' patch for renderer v3 execution #task-264

Browse Source
This commit is contained in:
authentik Default Admin
2026-03-09 20:35:38 +09:00
parent da31740cc2
commit 08077e8afa
6 changed files with 72 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
extension/out/extension.js
View File

@@ -303,6 +303,13 @@ async function setupApprovalObserver() {
continue;
}
let html = fs.readFileSync(htmlPath, 'utf8');
// CRITICAL: Patch CSP to allow inline scripts.
// Default CSP has script-src 'self' 'unsafe-eval' blob: — NO 'unsafe-inline'.
// Without 'unsafe-inline', all inline <script> tags are silently blocked.
if (html.includes('script-src') && !html.match(/script-src[^;]*'unsafe-inline'/)) {
html = html.replace(/(script-src\s[^;]*?)('self')/, "$1$2\n\t\t\t\t\t'unsafe-inline'");
logToFile(`[OBSERVER] ${htmlFileName} CSP patched: added 'unsafe-inline' to script-src`);
}
// Remove old external script tag if present (legacy, cannot be served)
const extMarkerStart = '<!-- AG SDK [variet-gravity-bridge] -->';
const extMarkerEnd = '<!-- /AG SDK [variet-gravity-bridge] -->';

2
extension/out/extension.js.map
View File

File diff suppressed because one or more lines are too long

11
extension/src/extension.ts
View File

@@ -265,6 +265,17 @@ async function setupApprovalObserver() {
}
let html = fs.readFileSync(htmlPath, 'utf8');
// CRITICAL: Patch CSP to allow inline scripts.
// Default CSP has script-src 'self' 'unsafe-eval' blob: — NO 'unsafe-inline'.
// Without 'unsafe-inline', all inline <script> tags are silently blocked.
if (html.includes('script-src') && !html.match(/script-src[^;]*'unsafe-inline'/)) {
html = html.replace(
/(script-src\s[^;]*?)('self')/,
"$1$2\n\t\t\t\t\t'unsafe-inline'"
);
logToFile(`[OBSERVER] ${htmlFileName} CSP patched: added 'unsafe-inline' to script-src`);
}
// Remove old external script tag if present (legacy, cannot be served)
const extMarkerStart = '<!-- AG SDK [variet-gravity-bridge] -->';
const extMarkerEnd = '<!-- /AG SDK [variet-gravity-bridge] -->';