--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit 1d11a7ab06d65bb53936dbf0c2cccf7de513007d
Parents : 4b9c16f
Author : Ivan <ivan@quad4.io>
Signature : Signature validation error
Date : 2026-04-23T17:46:31-05:00
feat(electron): fix Content Security Policy to include 'wasm-unsafe-eval' for script execution
Changes
4 files changed, 4 insertions(+), 3 deletions(-)
Diff
diff --git a/electron/crash.html b/electron/crash.html
index 277427d8..14d9ba16 100644
--- a/electron/crash.html
+++ b/electron/crash.html
@@ -4,7 +4,7 @@
<meta charset="UTF-8" />
<meta
http-equiv="Content-Security-Policy"
- content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
+ content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
/>
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
<title>MeshChatX - Crash Report</title>
diff --git a/electron/loading.html b/electron/loading.html
index 09850ae6..d81aa6d8 100644
--- a/electron/loading.html
+++ b/electron/loading.html
@@ -3,7 +3,7 @@
<meta charset="UTF-8" />
<meta
http-equiv="Content-Security-Policy"
- content="default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' http://127.0.0.1:9337 https://127.0.0.1:9337 http://localhost:9337 https://localhost:9337;"
+ content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' http://127.0.0.1:9337 https://127.0.0.1:9337 http://localhost:9337 https://localhost:9337;"
/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
diff --git a/electron/main.js b/electron/main.js
index 95b0a7d9..5ac692ec 100644
--- a/electron/main.js
+++ b/electron/main.js
@@ -506,7 +506,7 @@ app.whenReady().then(async () => {
// Define a robust fallback CSP that matches our backend's policy
const fallbackCsp = [
"default-src 'self'",
- "script-src 'self' 'unsafe-inline'",
+ "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'",
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data: blob: https://*.tile.openstreetmap.org https://tile.openstreetmap.org https://*.cartocdn.com https://tiles.openfreemap.org https://*.openfreemap.org",
"font-src 'self' data: https://tiles.openfreemap.org https://*.openfreemap.org",
diff --git a/tests/backend/test_csp_logic.py b/tests/backend/test_csp_logic.py
index f660eda0..fd1aa6a5 100644
--- a/tests/backend/test_csp_logic.py
+++ b/tests/backend/test_csp_logic.py
@@ -66,6 +66,7 @@ async def test_csp_header_logic(mock_rns_minimal, tmp_path):
assert "https://api.example.com" in csp
assert "https://tiles.example.com" in csp
assert "default-src 'self'" in csp
+ assert "wasm-unsafe-eval" in csp
@pytest.mark.asyncio
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────