@cloudbase/cals 1.2.19 → 1.2.21-alpha.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -494,19 +494,68 @@ _Dependencies_schema = new WeakMap(), _Dependencies_request = new WeakMap(), _De
494
494
  function loadProdMetaScript(bundleName, filename) {
495
495
  return new Promise((resolve, reject) => __awaiter(this, void 0, void 0, function* () {
496
496
  try {
497
- const script = document.createElement('script');
498
- script.setAttribute('src', filename);
499
- script.setAttribute('class', '@weapps-materials-control');
500
- script.addEventListener('load', () => {
501
- const moduleName = `@weapps-materials-control-${bundleName}`;
502
- if (Object.prototype.hasOwnProperty.call(window, moduleName)) {
503
- const value = window[moduleName];
504
- return resolve(value);
497
+ const iframe = document.createElement('iframe');
498
+ iframe.setAttribute('sandbox', 'allow-scripts');
499
+ iframe.style.display = 'none';
500
+ const moduleName = `@weapps-materials-control-${bundleName}`;
501
+ const messageHandler = (event) => {
502
+ // 安全检查:确保消息来自我们刚刚创建的iframe
503
+ if (event.source !== iframe.contentWindow) {
504
+ return;
505
505
  }
506
- return reject(new Error(`meta bundle [${bundleName}] must build with UMD`));
507
- });
508
- script.addEventListener('error', (e) => reject(`meta bundle [${bundleName}] load failed: ${(e === null || e === void 0 ? void 0 : e.message) || ''}`));
509
- document.body.appendChild(script);
506
+ const { status, data, error } = event.data;
507
+ document.body.removeChild(iframe);
508
+ window.removeEventListener('message', messageHandler);
509
+ if (status === 'success') {
510
+ resolve(data);
511
+ }
512
+ else if (status === 'error') {
513
+ reject(new Error(error));
514
+ }
515
+ };
516
+ window.addEventListener('message', messageHandler);
517
+ // 从下面这段是 iframe-srcdoc.src.js 中搞出来的
518
+ const scriptStr = "window.addEventListener('message', (event) => {\n" +
519
+ ' const { data, origin } = event;\n' +
520
+ ' const { filename, bundleName, moduleName } = data;\n' +
521
+ " const script = document.createElement('script');\n" +
522
+ " script.setAttribute('src', filename);\n" +
523
+ " script.setAttribute('class', '@weapps-materials-control');\n" +
524
+ " script.addEventListener('load', () => {\n" +
525
+ ' if (Object.prototype.hasOwnProperty.call(window, moduleName)) {\n' +
526
+ " parent.postMessage({ status: 'success', data: window[moduleName] }, origin);\n" +
527
+ ' } else {\n' +
528
+ " parent.postMessage({ status: 'error', error: `meta bundle [${bundleName}] must build with UMD` }, origin);\n" +
529
+ ' }\n' +
530
+ ' });\n' +
531
+ " script.addEventListener('error', (e) => {\n" +
532
+ ' parent.postMessage(\n' +
533
+ " { status: 'error', error: `meta bundle [${bundleName}] load failed: ${e?.message || ''}` },\n" +
534
+ ' origin,\n' +
535
+ ' );\n' +
536
+ ' });\n' +
537
+ " window.addEventListener('error', (event) => {\n" +
538
+ ' parent.postMessage(\n' +
539
+ " { status: 'error', error: `meta bundle [${bundleName}] load failed: ${event?.message || ''}` },\n" +
540
+ ' origin,\n' +
541
+ ' );\n' +
542
+ ' });\n' +
543
+ ' document.body.appendChild(script);\n' +
544
+ '});\n';
545
+ const scriptOrigin = new URL(filename).origin;
546
+ const csp = `default-src 'none'; script-src 'unsafe-inline' ${scriptOrigin};`;
547
+ iframe.srcdoc = `
548
+ <html>
549
+ <head>
550
+ <meta http-equiv="Content-Security-Policy" content="${csp}">
551
+ </head>
552
+ <body>
553
+ <script>${scriptStr}</script>
554
+ </body>
555
+ </html>
556
+ `;
557
+ iframe.contentWindow.postMessage({ filename, bundleName, moduleName }, window.location.origin);
558
+ document.body.appendChild(iframe);
510
559
  }
511
560
  catch (e) {
512
561
  const isNode = typeof global === 'object' && global.global === global;