Lucas WintherandClaude Opus 5.5
0da35ec6f8
The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP. Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options. Co-Authored-By: Claude Opus 5.5 <[email protected]>
19 lines
1.0 KiB
HTML
19 lines
1.0 KiB
HTML
<!doctype html>
|
|
<html lang="en">
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1">
|
|
<!-- CSP (learner review C1, ruling R16). No inline script: the one hash is Bun's dev-server helper
|
|
(/_bun/unref beacon), which production builds do not inject. frame-ancestors cannot be set in a meta tag;
|
|
see docs/contract-requests/learner.md section 5. -->
|
|
<meta http-equiv="Content-Security-Policy" content="default-src 'self'; script-src 'self' 'sha256-ES8VF47udzjVFFPh4RhgcgjUrADRd1Ef0GD9UagS2mY='; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; worker-src 'self' blob:; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'">
|
|
<title>STCourses</title>
|
|
<link rel="stylesheet" href="../../packages/ui/src/fonts.css">
|
|
<link rel="stylesheet" href="../../packages/ui/src/tokens.css">
|
|
</head>
|
|
<body>
|
|
<div id="root"></div>
|
|
<script type="module" src="./src/main.tsx"></script>
|
|
</body>
|
|
</html>
|