@lvce-editor/shared-process 0.34.5 → 0.34.6

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lvce-editor/shared-process",
-  "version": "0.34.5",
+  "version": "0.34.6",
   "main": "index.js",
   "type": "module",
   "keywords": [
@@ -18,7 +18,7 @@
   },
   "dependencies": {
     "@lvce-editor/assert": "^1.3.0",
-    "@lvce-editor/extension-host-helper-process": "0.34.5",
+    "@lvce-editor/extension-host-helper-process": "0.34.6",
     "@lvce-editor/ipc": "^11.0.1",
     "@lvce-editor/json-rpc": "^4.0.0",
     "@lvce-editor/jsonc-parser": "^1.4.0",

package/src/parts/ExportStatic/ExportStatic.js

@@ -1,8 +1,19 @@
 import { existsSync } from 'node:fs';
 import { isAbsolute, join } from 'node:path';
 import * as FileSystem from '../FileSystem/FileSystem.js';
+import * as GetContentSecurityPolicy from '../GetContentSecurityPolicy/GetContentSecurityPolicy.js';
 import * as JsonFile from '../JsonFile/JsonFile.js';
 import * as Path from '../Path/Path.js';
+const staticContentSecurityPolicy = GetContentSecurityPolicy.getContentSecurityPolicy([
+    `default-src 'none'`,
+    `font-src 'self'`,
+    `img-src 'self' https: data: blob:`, // TODO maybe disallow https and data images
+    `manifest-src 'self'`,
+    `media-src 'self'`,
+    `script-src 'self'`,
+    `style-src 'self'`,
+    `frame-src 'self' blob:`,
+]);
 const readExtensionManifest = async (path) => {
     const json = await JsonFile.readJson(path);
     return { ...json, path };
@@ -137,13 +148,16 @@ const applyOverrides = async ({ root, commitHash, pathPrefix, serverStaticPath }
         const iconThemeId = iconThemeDirent.slice('builtin.'.length);
         await FileSystem.copy(Path.join(serverStaticPath, commitHash, 'extensions', iconThemeDirent, 'icon-theme.json'), Path.join(root, 'dist', commitHash, 'icon-themes', `${iconThemeId}.json`));
     }
-    await replace(Path.join(root, 'dist', 'index.html'), `/${commitHash}`, `${pathPrefix}/${commitHash}`);
+    const indexHtmlPath = Path.join(root, 'dist', 'index.html');
+    await replace(indexHtmlPath, `/${commitHash}`, `${pathPrefix}/${commitHash}`);
+    await replace(indexHtmlPath, '</title>', `</title>
+    <meta http-equiv="Content-Security-Policy" content="${staticContentSecurityPolicy}">`);
     if (pathPrefix) {
-        await replace(Path.join(root, 'dist', 'index.html'), '</title>', `</title>
+        await replace(indexHtmlPath, '</title>', `</title>
     <link rel="shortcut icon" type="image/x-icon" href="${pathPrefix}/favicon.ico">`);
     }
     else {
-        await replace(Path.join(root, 'dist', 'index.html'), '</title>', `</title>
+        await replace(indexHtmlPath, '</title>', `</title>
     <link rel="shortcut icon" type="image/x-icon" href="favicon.ico">`);
     }
     if (pathPrefix) {

package/src/parts/Platform/Platform.js

@@ -41,9 +41,9 @@ export const getAppImageName = () => {
 export const getSetupName = () => {
     return 'Lvce-Setup';
 };
-export const version = '0.34.5';
-export const commit = '73f3742';
-export const date = '2024-09-15T12:29:53.000Z';
+export const version = '0.34.6';
+export const commit = 'a8931f9';
+export const date = '2024-09-15T14:22:54.000Z';
 export const getVersion = () => {
     return version;
 };