tkmind/memind
1
0
Fork 0
Code Issues Pull Requests 2 Actions Packages Projects Releases Wiki Activity

fix(csp): allow page-data-client.js in WeChat WebView

Browse Source 
WeChat UA uses a relaxed inline CSP without 'self', which blocked
/assets/page-data-client.js and broke public survey submissions.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
john
2026-07-12 22:21:57 +08:00
parent ca4805533b
commit 2f7bc3b6e4
2 changed files with 20 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
mindspace-published-page-csp.mjs
+8 -1
View File
@@ -21,7 +21,14 @@ export function publishedPageCsp(
return publishedPageCspForEmbed(true); return publishedPageCspForEmbed(true);
} }
if (wechatShare && isFullHtml) { if (wechatShare && isFullHtml) {
return "default-src 'none'; style-src 'unsafe-inline' https:; img-src 'self' data: http: https:; font-src 'self' https: data:; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; script-src 'unsafe-inline' https://res.wx.qq.com"; const scriptSrc = scriptSrcDirective({
inline: true,
urls: [
...(htmlUsesExternalScriptSrc(html) ? ["'self'"] : []),
'https://res.wx.qq.com',
],
});
return `default-src 'none'; style-src 'unsafe-inline' https:; img-src 'self' data: http: https:; font-src 'self' https: data:; connect-src 'self'; base-uri 'none'; form-action 'self'; frame-ancestors 'self'; ${scriptSrc}`;
} }
if (raw && isFullHtml) { if (raw && isFullHtml) {
const scriptSrc = scriptSrcDirective({ const scriptSrc = scriptSrcDirective({
mindspace-published-page-csp.test.mjs
+12
View File
@@ -23,3 +23,15 @@ test('publishedPageCsp non-raw full html allows self when external scripts are p
const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: false }); const csp = publishedPageCsp(PAGE_DATA_HTML, { raw: false });
assert.match(csp, /script-src 'self'/); assert.match(csp, /script-src 'self'/);
}); });
test('publishedPageCsp wechatShare mode allows self when page-data-client.js is referenced', () => {
const csp = publishedPageCsp(PAGE_DATA_HTML, { wechatShare: true });
assert.match(csp, /script-src 'unsafe-inline' 'self' https:\/\/res\.wx\.qq\.com/);
});
test('publishedPageCsp wechatShare mode keeps inline-only pages without self', () => {
const html = '<!doctype html><html><body><script>console.log(1)</script></body></html>';
const csp = publishedPageCsp(html, { wechatShare: true });
assert.match(csp, /script-src 'unsafe-inline' https:\/\/res\.wx\.qq\.com/);
assert.doesNotMatch(csp, /script-src 'unsafe-inline' 'self'/);
});