tkmind/memind
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(csp): allow page-data-client.js in WeChat WebView

Browse Source 
WeChat UA uses a relaxed inline CSP without 'self', which blocked
/assets/page-data-client.js and broke public survey submissions.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
john
2026-07-12 22:21:57 +08:00
parent ca4805533b
commit 2f7bc3b6e4
2 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mindspace-published-page-csp.mjs
+8 -1
View File
@@ -21,7 +21,14 @@ export function publishedPageCsp(
return publishedPageCspForEmbed(true);
}
if (wechatShare && isFullHtml) {
return "default-src 'none'; style-src 'unsafe-inline' https:; img-src 'self' data: http: https:; font-src 'self' https: data:; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; script-src 'unsafe-inline' https://res.wx.qq.com";
const scriptSrc = scriptSrcDirective({
inline: true,
urls: [
...(htmlUsesExternalScriptSrc(html) ? ["'self'"] : []),
'https://res.wx.qq.com',
],
});
return `default-src 'none'; style-src 'unsafe-inline' https:; img-src 'self' data: http: https:; font-src 'self' https: data:; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; ${scriptSrc}`;
}
if (raw && isFullHtml) {
const scriptSrc = scriptSrcDirective({