diff --git a/mindspace-published-page-csp.mjs b/mindspace-published-page-csp.mjs index dd480d3..8918ac5 100644 --- a/mindspace-published-page-csp.mjs +++ b/mindspace-published-page-csp.mjs @@ -21,7 +21,14 @@ export function publishedPageCsp( return publishedPageCspForEmbed(true); } if (wechatShare && isFullHtml) { - return "default-src 'none'; style-src 'unsafe-inline' https:; img-src 'self' data: http: https:; font-src 'self' https: data:; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; script-src 'unsafe-inline' https://res.wx.qq.com"; + const scriptSrc = scriptSrcDirective({ + inline: true, + urls: [ + ...(htmlUsesExternalScriptSrc(html) ? ["'self'"] : []), + 'https://res.wx.qq.com', + ], + }); + return `default-src 'none'; style-src 'unsafe-inline' https:; img-src 'self' data: http: https:; font-src 'self' https: data:; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; ${scriptSrc}`; } if (raw && isFullHtml) { const scriptSrc = scriptSrcDirective({ diff --git a/mindspace-published-page-csp.test.mjs b/mindspace-published-page-csp.test.mjs index 29d14b6..6962b3b 100644 --- a/mindspace-published-page-csp.test.mjs +++ b/mindspace-published-page-csp.test.mjs @@ -23,3 +23,15 @@ test('publishedPageCsp non-raw full html allows self when external scripts are p const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: false }); assert.match(csp, /script-src 'self'/); }); + +test('publishedPageCsp wechatShare mode allows self when page-data-client.js is referenced', () => { + const csp = publishedPageCsp(PAGE_DATA_HTML, { wechatShare: true }); + assert.match(csp, /script-src 'unsafe-inline' 'self' https:\/\/res\.wx\.qq\.com/); +}); + +test('publishedPageCsp wechatShare mode keeps inline-only pages without self', () => { + const html = ''; + const csp = publishedPageCsp(html, { wechatShare: true }); + assert.match(csp, /script-src 'unsafe-inline' https:\/\/res\.wx\.qq\.com/); + assert.doesNotMatch(csp, /script-src 'unsafe-inline' 'self'/); +});