@kehto/paja 0.15.1 → 0.15.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +3 -2
- package/dist/browser-host.js +1 -1
- package/dist/browser-host.js.map +1 -1
- package/dist/{chunk-DTRRHXYY.js → chunk-32QBJDAR.js} +2 -2
- package/dist/chunk-32QBJDAR.js.map +1 -0
- package/dist/cli.js +1 -1
- package/dist/index.js +1 -1
- package/package.json +3 -3
- package/dist/chunk-DTRRHXYY.js.map +0 -1
package/README.md
CHANGED
|
@@ -219,8 +219,9 @@ shim capability.
|
|
|
219
219
|
|
|
220
220
|
Before Paja assigns a verified runtime-pointer document to `srcdoc`, it inserts
|
|
221
221
|
Kehto's local Class-1 CSP before the host-owned namespace prelude. The policy
|
|
222
|
-
denies all defaults; permits inline script/style,
|
|
223
|
-
|
|
222
|
+
denies all defaults; permits inline script/style, WebAssembly compilation through
|
|
223
|
+
the narrow `'wasm-unsafe-eval'` source, `data:`/`blob:` images, and `data:` fonts;
|
|
224
|
+
keeps JavaScript string evaluation blocked; grants `connect-src` only to the resolved relay and Blossom
|
|
224
225
|
origins; explicitly denies worker, child, frame, media, object, manifest,
|
|
225
226
|
prefetch, base, and form capabilities; and ends with `frame-ancestors 'self'`.
|
|
226
227
|
The NIP-5D verified-srcdoc and opaque-sandbox rules do not mandate this CSP;
|
package/dist/browser-host.js
CHANGED
|
@@ -20011,7 +20011,7 @@ function injectPajaRuntimeCsp(html, origins) {
|
|
|
20011
20011
|
const connectSrc = grantedOrigins.length > 0 ? `connect-src ${grantedOrigins.join(" ")}` : "connect-src 'none'";
|
|
20012
20012
|
const value = [
|
|
20013
20013
|
"default-src 'none'",
|
|
20014
|
-
"script-src 'unsafe-inline'",
|
|
20014
|
+
"script-src 'unsafe-inline' 'wasm-unsafe-eval'",
|
|
20015
20015
|
"style-src 'unsafe-inline'",
|
|
20016
20016
|
"img-src data: blob:",
|
|
20017
20017
|
"font-src data:",
|