tkmind/memind
1
0
Fork 0
Code Issues Pull Requests 1 Actions Packages Projects Releases Wiki Activity

fix(csp): allow page-data-client.js in WeChat WebView

Browse Source 
WeChat UA uses a relaxed inline CSP without 'self', which blocked
/assets/page-data-client.js and broke public survey submissions.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
john
2026-07-12 22:21:57 +08:00
parent ca4805533b
commit 2f7bc3b6e4
2 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mindspace-published-page-csp.test.mjs
+12
View File
@@ -23,3 +23,15 @@ test('publishedPageCsp non-raw full html allows self when external scripts are p
const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: false });
assert.match(csp, /script-src 'self'/);
});
test('publishedPageCsp wechatShare mode allows self when page-data-client.js is referenced', () => {
const csp = publishedPageCsp(PAGE_DATA_HTML, { wechatShare: true });
assert.match(csp, /script-src 'unsafe-inline' 'self' https:\/\/res\.wx\.qq\.com/);
});
test('publishedPageCsp wechatShare mode keeps inline-only pages without self', () => {
const html = '<!doctype html><html><body><script>console.log(1)</script></body></html>';
const csp = publishedPageCsp(html, { wechatShare: true });
assert.match(csp, /script-src 'unsafe-inline' https:\/\/res\.wx\.qq\.com/);
assert.doesNotMatch(csp, /script-src 'unsafe-inline' 'self'/);
});