Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

build: fix SvelteKit CSP 'stric-dynamic' issue in Firefox #1451

Merged
merged 4 commits into from
Oct 13, 2022
Merged

build: fix SvelteKit CSP 'stric-dynamic' issue in Firefox #1451

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6e714b1
build: fix SvelteKit CSP 'stric-dynamic' issue in Firefox
peterpeterparker Oct 13, 2022
7c5b50a
chore: naming
peterpeterparker Oct 13, 2022
5d87f84
chore: naming
peterpeterparker Oct 13, 2022
9f7fd82
chore: format
peterpeterparker Oct 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 38 additions & 7 deletions frontend/scripts/build.csp.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,8 +8,43 @@ import { join } from "path";
dotenv.config();

const buildCsp = () => {
const updatedIndexHTML = updateCSP();
writeFileSync("./public/index.html", updatedIndexHTML);
const indexHTMLWithoutStartScript = extractStartScript();
const indexHTMLWithCSP = updateCSP(indexHTMLWithoutStartScript);
writeFileSync("./public/index.html", indexHTMLWithCSP);
};

/**
* Using a CSP with 'strict-dynamic' with SvelteKit breaks in Firefox.
* Issue: https://github.com/sveltejs/kit/issues/3558
*
* As workaround:
* 1. we extract the start script that is injected by SvelteKit in index.html into a separate main.js
* 2. we remove the script content from index.html but, let the script tag as anchor
* 3. we use our custom script loader to load the main.js script
*/
const extractStartScript = () => {
const indexHtml = readFileSync(
join(process.cwd(), "public", "index.html"),
"utf-8"
);

const svelteKitStartScript =
/(<script type=\"module\" data-sveltekit-hydrate[\s\S]*?>)([\s\S]*?)(<\/script>)/gm;

// 1. extract SvelteKit start script to a separate main.js file
const m = svelteKitStartScript.exec(indexHtml);
const content = m[2];

const inlineScript = content.replace(/^\s*/gm, "");

writeFileSync(
join(process.cwd(), "public", "main.js"),
inlineScript,
"utf-8"
);

// 2. replace SvelteKit script tag content with empty
return indexHtml.replace(svelteKitStartScript, "$1$3");
};

/**
Expand Down Expand Up @@ -37,11 +72,7 @@ const buildCsp = () => {
* 1. svelte uses inline style for animation (scale, fly, fade, etc.)
* source: https://github.com/sveltejs/svelte/issues/6662
*/
const updateCSP = () => {
const indexHtml = readFileSync(
join(process.cwd(), "public", "index.html"),
"utf-8"
);
const updateCSP = (indexHtml) => {
const sw = /<script[\s\S]*?>([\s\S]*?)<\/script>/gm;

const indexHashes = [];
Expand Down
7 changes: 7 additions & 0 deletions frontend/src/app.html
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -107,6 +107,13 @@
}
</script>

<script>
const loader = document.createElement("script");
loader.type = "module";
loader.src = "./main.js";
document.head.appendChild(loader);
</script>

%sveltekit.head%
</head>
<body>
Expand Down