Lucas WintherandClaude Opus 5.5
0da35ec6f8
The proxy, its internal server, Unix socket and NO_PROXY changes are gone; main.ts serves the HTML import directly again. apps/web/index.html carries the SPA policy as <meta http-equiv=CSP> ahead of every script (script-src 'self' plus the hash of Bun's dev-server helper, no unsafe-inline/eval; no frame-ancestors, which meta cannot carry). Dev HMR connects under it. The runner frame keeps its header CSP. Tests: the served index.html (prod and dev, in a subprocess) has the meta policy and every inline script is hash-covered; the XSS browser test fails with the sanitizer disabled and passes with it, and the meta CSP alone blocks unsanitized handlers (with a no-CSP control); no source assigns proxy env vars, and the feature leaves them untouched at runtime. Contract request 5 asks core for frame-ancestors/X-Frame-Options. Co-Authored-By: Claude Opus 5.5 <[email protected]>
13 lines
651 B
TypeScript
13 lines
651 B
TypeScript
// Run by csp.test.ts in a subprocess (bundling an HTML import inside a full bun test run is unreliable):
|
|
// serves apps/web/index.html the way main.ts does, as a plain Bun HTML import, and prints the document.
|
|
import indexHtml from "../../../../apps/web/index.html";
|
|
|
|
const development = process.argv[2] === "dev";
|
|
const server = Bun.serve({ hostname: "127.0.0.1", port: 0, routes: { "/*": indexHtml }, development });
|
|
try {
|
|
const r = await fetch(`http://127.0.0.1:${server.port}/c/sample/m1-intro`);
|
|
console.log(JSON.stringify({ status: r.status, type: r.headers.get("content-type"), html: await r.text() }));
|
|
} finally {
|
|
server.stop(true);
|
|
}
|