dsh-mobile 0.1.0-alpha.10 → 0.1.0-alpha.11
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SECURITY.md +1 -1
- package/lib/index.mjs +1 -1
- package/package.json +1 -1
package/SECURITY.md
CHANGED
|
@@ -27,6 +27,6 @@ The maintainer will acknowledge a complete report within seven days. Publication
|
|
|
27
27
|
|
|
28
28
|
## Known alpha limitation
|
|
29
29
|
|
|
30
|
-
The current DSH HTML boot process contains inline JavaScript and applies some styles dynamically. To keep the stock Web UI runnable, the gateway's Content Security Policy currently includes `script-src 'self' 'unsafe-inline'` and `style-src 'self' 'unsafe-inline'`. The remaining directives still restrict origins, connections, frames, objects, workers, images, and form targets, but this policy does not eliminate script-injection risk. Removing these allowances requires upstream DSH support for nonces, stable hashes,
|
|
30
|
+
The current DSH HTML boot process contains inline JavaScript, revives Schemastery callbacks with `new Function`, and applies some styles dynamically. To keep the stock Web UI runnable, the gateway's Content Security Policy currently includes `script-src 'self' 'unsafe-inline' 'unsafe-eval'` and `style-src 'self' 'unsafe-inline'`. The remaining directives still restrict origins, connections, frames, objects, workers, images, and form targets, but this policy does not eliminate script-injection risk. Removing these allowances requires upstream DSH support for nonces, stable hashes, external boot resources, and a non-evaluating schema representation.
|
|
31
31
|
|
|
32
32
|
This repository never accepts private keys, npm tokens, pairing values, device credentials, Cookies, or captured settings in issues, logs, fixtures, or example configuration.
|
package/lib/index.mjs
CHANGED
|
@@ -953,7 +953,7 @@ function setSecurityHeaders(response, tls) {
|
|
|
953
953
|
"object-src 'none'",
|
|
954
954
|
"frame-ancestors 'none'",
|
|
955
955
|
"form-action 'self'",
|
|
956
|
-
"script-src 'self' 'unsafe-inline'",
|
|
956
|
+
"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
|
|
957
957
|
"style-src 'self' 'unsafe-inline'",
|
|
958
958
|
"img-src 'self' data: blob:",
|
|
959
959
|
"font-src 'self' data:",
|