Files
memind/mindspace-published-script-localize.mjs
T
john aede1e6fcb fix(mindspace): guard published pages against blocked CDN scripts
Pre-bundle Chart.js, auto-rewrite common CDN references at publish and serve time, and block unknown external script src during publication scans so interactive dashboards keep working under CSP.

Co-authored-by: Cursor <cursoragent@cursor.com>
2026-07-10 10:27:42 +08:00

69 lines
2.1 KiB
JavaScript

const SCRIPT_SRC_PATTERN = /<script\b([^>]*)\bsrc\s*=\s*(['"])([^'"]+)\2([^>]*)>/gi;
export const KNOWN_PLATFORM_SCRIPT_ALIASES = [
{
id: 'chart.js',
target: '/assets/chart.umd.min.js',
patterns: [
/cdn\.jsdelivr\.net\/npm\/chart\.js(?:@[^/]+)?\/dist\/chart\.(?:umd\.)?min\.js/i,
/cdnjs\.cloudflare\.com\/ajax\/libs\/Chart\.js\/[^/]+\/chart\.(?:umd\.)?min\.js/i,
/unpkg\.com\/chart\.js(?:@[^/]+)?\/dist\/chart\.(?:umd\.)?min\.js/i,
],
},
];
function normalizeScriptUrl(value) {
return String(value ?? '').trim().replace(/&amp;/g, '&');
}
export function isExternalScriptSrc(src) {
const normalized = normalizeScriptUrl(src);
if (!normalized) return false;
if (/^https?:\/\//i.test(normalized)) return true;
if (/^\/\//.test(normalized)) return true;
return false;
}
function resolveKnownPlatformScriptTarget(src) {
const normalized = normalizeScriptUrl(src);
if (!isExternalScriptSrc(normalized)) return null;
const probe = normalized.startsWith('//') ? `https:${normalized}` : normalized;
for (const alias of KNOWN_PLATFORM_SCRIPT_ALIASES) {
if (alias.patterns.some((pattern) => pattern.test(probe))) {
return alias.target;
}
}
return null;
}
export function findExternalScriptSources(html) {
const sources = [];
const seen = new Set();
for (const match of String(html ?? '').matchAll(SCRIPT_SRC_PATTERN)) {
const src = normalizeScriptUrl(match[3]);
if (!isExternalScriptSrc(src) || seen.has(src)) continue;
seen.add(src);
sources.push(src);
}
return sources;
}
export function rewriteKnownCdnScriptSources(html) {
const rewrites = [];
const next = String(html ?? '').replace(
SCRIPT_SRC_PATTERN,
(full, before, quote, src, after) => {
const normalized = normalizeScriptUrl(src);
const target = resolveKnownPlatformScriptTarget(normalized);
if (!target) return full;
rewrites.push({ from: normalized, to: target });
return `<script${before}src=${quote}${target}${quote}${after}>`;
},
);
return {
html: next,
rewrittenCount: rewrites.length,
rewrites,
};
}