k1nq/TREK
1
0
Fork 0
mirror of https://github.com/mauriceboe/TREK.git synced 2026-10-20 05:56:53 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(plugins): allow inline scripts in the sandboxed frame + fix server lint error

Browse Source 
- Plugin frame CSP: the frame runs at an opaque origin (sandbox without
  allow-same-origin), so script-src 'self' matches nothing and the widget's own
  script never runs (stuck on 'Loading…'). Allow 'unsafe-inline' — the sandbox,
  not this directive, is the isolation boundary, and the plugin author controls
  the frame code either way.
- Fix a no-constant-binary-expression eslint error in registry.test.ts that was
  failing the server lint:check (eslint .) in CI.
This commit is contained in:
mauriceboe
2026-07-03 18:36:32 +02:00
committed by Maurice
parent a7dc4fbfe7
commit 7cd5a5d04c
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
server/src/nest/plugins/plugin-frame.controller.ts
+5 -1
View File
@@ -71,7 +71,11 @@ export class PluginFrameController {
const connect = ["'self'", ...outbound.map((h) => (h.includes('://') ? h : `https://${h}`))].join(' ');
return [
"default-src 'none'",
"script-src 'self'",
// The frame runs at an OPAQUE origin (sandbox without allow-same-origin),
// so 'self' matches nothing — inline is the only way its own script can run.
// Safe here: the sandbox (not this script-src) is the isolation boundary,
// and the plugin author controls the frame's code either way.
"script-src 'self' 'unsafe-inline'",
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data: blob:",
"font-src 'self' data:",