diff --git a/identifier/api.go b/identifier/api.go index 1be19fc..ea553de 100644 --- a/identifier/api.go +++ b/identifier/api.go @@ -35,10 +35,10 @@ func (i *Identifier) writeWebappIndexHTML(rw http.ResponseWriter, req *http.Requ // FIXME(longsleep): Set a secure CSP. Right now we need `data:` for images // since it is used. Since `data:` URLs possibly could allow xss, a better // way should be found for our early loading inline SVG stuff. - rw.Header().Set("Content-Security-Policy", fmt.Sprintf("default-src 'self'; img-src 'self' data:; font-src 'self' data:; script-src 'self'; style-src 'self' 'nonce-%s'; base-uri 'none'; frame-ancestors 'none';", nonce)) + rw.Header().Set("Content-Security-Policy", fmt.Sprintf("default-src 'self'; img-src 'self' data:; font-src 'self' data:; script-src 'self' 'nonce-%s'; style-src 'self' 'nonce-%s'; base-uri 'none'; frame-ancestors 'none';", nonce, nonce)) // Write index with random nonce to response. - index := bytes.Replace(i.webappIndexHTML, []byte("__CSP_NONCE__"), []byte(nonce), 1) + index := bytes.ReplaceAll(i.webappIndexHTML, []byte("__CSP_NONCE__"), []byte(nonce)) rw.Write(index) } diff --git a/identifier/package.json b/identifier/package.json index 8f72418..21951cc 100644 --- a/identifier/package.json +++ b/identifier/package.json @@ -50,6 +50,7 @@ "@typescript-eslint/eslint-plugin": "^6.11.0", "@typescript-eslint/parser": "^6.9.0", "@typescript-eslint/typescript-estree": "^6.11.0", + "@vitejs/plugin-legacy": "^4.0.0", "@vitejs/plugin-react": "^4.1.1", "cldr": "^7.4.0", "eslint": "^8.53.0", @@ -60,6 +61,7 @@ "if-node-version": "^1.1.1", "jsdom": "^22.1.0", "source-map-explorer": "^2.5.3", + "terser": "^5.30.4", "typescript": "^5.2.2", "vite": "^4.5.2", "vite-plugin-checker": "^0.6.2", diff --git a/identifier/vite.config.js b/identifier/vite.config.js index d89a6a2..8af1d0b 100644 --- a/identifier/vite.config.js +++ b/identifier/vite.config.js @@ -1,6 +1,31 @@ -import { defineConfig, splitVendorChunkPlugin } from 'vite'; -import react from '@vitejs/plugin-react'; -import checker from 'vite-plugin-checker'; +import { defineConfig, splitVendorChunkPlugin } from "vite"; +import react from "@vitejs/plugin-react"; +import checker from "vite-plugin-checker"; +import legacy from "@vitejs/plugin-legacy"; + + +const addScriptCSPNoncePlaceholderPlugin = () => { + return { + name: "add-script-nonce-placeholderP-plugin", + apply: "build", + transformIndexHtml: { + order: "post", + handler(htmlData) { + + return htmlData.replaceAll( + /