Skip to content

Commit ff3dc86

Browse files
authored
security: Allow setting stricter CSP. (#2460)
1 parent 8b9035a commit ff3dc86

File tree

9 files changed

+4034
-2865
lines changed

9 files changed

+4034
-2865
lines changed

tools/showcase/showcase.py

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -104,7 +104,11 @@ def make_screenshot(code: List[str], img_name: str, page,
104104
if 'ui.form_card' in code_str:
105105
widget_count = len(page.query_selector_all(f'{selector} > :first-child > *'))
106106
selector = f'{selector} > *' if widget_count > 1 else f'{selector} > :first-child > *'
107-
page.wait_for_selector(selector)
107+
try:
108+
page.wait_for_selector(selector)
109+
except Exception:
110+
print(f'Selector {selector} timed out for {img_name} after 30s.')
111+
return
108112
print(f'Generating {img_name}')
109113
page.query_selector(selector).screenshot(path=path)
110114
if is_test and not is_base:

ui/index.html

Lines changed: 21 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<!DOCTYPE html>
1+
<!doctype html>
22
<html lang="en">
33

44
<head>
@@ -9,23 +9,32 @@
99
<meta name="theme-color" content="#000000" />
1010
<meta name="description" content="H2O Wave App" />
1111
<link rel="manifest" href="manifest.json" crossorigin="use-credentials" />
12-
<link href="/assets/inter.css" rel="stylesheet">
12+
<link href="/assets/inter.css" rel="stylesheet" />
1313
<title>H2O Wave</title>
1414
</head>
1515

1616
<body>
1717
<noscript>You need to enable JavaScript to run this app.</noscript>
1818
<div id="wave-root"></div>
19-
<!--
20-
This HTML file is a template.
21-
If you open it directly in the browser, you will see an empty page.
22-
23-
You can add webfonts, meta tags, or analytics to this file.
24-
The build step will place the bundled scripts into the <body> tag.
25-
26-
To begin the development, run `npm start` or `yarn start`.
27-
To create a production bundle, use `npm run build` or `yarn build`.
28-
-->
19+
<!-- Ensure this JS runs absolutely first to avoid race conditions. -->
20+
<script>
21+
const nonce = document.body.dataset.nonce
22+
const originalInsertBefore = Element.prototype.insertBefore
23+
const originalAppendChild = Element.prototype.appendChild
24+
window.CSPSettings = { nonce }
25+
Element.prototype.insertBefore = function (newNode, referenceNode) {
26+
if (nonce && newNode.nodeType === 1 && newNode.hasAttribute("data-merge-styles")) {
27+
newNode.setAttribute("nonce", nonce)
28+
}
29+
return originalInsertBefore.call(this, newNode, referenceNode)
30+
}
31+
Element.prototype.appendChild = function (newNode) {
32+
if (nonce && newNode.nodeType === 1 && newNode.nodeName === 'SCRIPT' || newNode.nodeName === 'STYLE') {
33+
newNode.setAttribute("nonce", nonce)
34+
}
35+
return originalAppendChild.call(this, newNode)
36+
};
37+
</script>
2938
<script type="module" src="/src/index.tsx"></script>
3039
</body>
3140

0 commit comments

Comments
 (0)