收紧桌面壳脚本 CSP 门禁

校验 release CSP 的 script-src 只能为 self

校验 dev CSP 的 script-src 只能为 self

避免脚本 CSP 通过追加 inline 来源静默放宽

apps/desktop-shell/scripts/check-config.mjs

@@ -637,6 +637,33 @@ function pathRelative(fromPath, toPath) {
     .replace(/\/$/, '');
 }
 
+function cspDirectiveValues(source, directiveName) {
+  const directive = source
+    .split(';')
+    .map((entry) => entry.trim())
+    .find((entry) => entry.startsWith(`${directiveName} `));
+  if (!directive) {
+    return [];
+  }
+
+  return directive
+    .split(/\s+/)
+    .slice(1)
+    .filter(Boolean);
+}
+
+function assertExactCspDirective(source, directiveName, expectedValues, label) {
+  const actualValues = cspDirectiveValues(source, directiveName);
+  if (
+    actualValues.length !== expectedValues.length ||
+    expectedValues.some((value, index) => actualValues[index] !== value)
+  ) {
+    throw new Error(
+      `${label} ${directiveName} must be ${[directiveName, ...expectedValues].join(' ')}`,
+    );
+  }
+}
+
 const productionSourceFiles = productionSourceRoots.flatMap((root) =>
   collectProductionSourceFiles(root),
 );
@@ -2429,6 +2456,9 @@ for (const requiredDevCspToken of [
   }
 }
 
+assertExactCspDirective(csp, 'script-src', ["'self'"], 'desktop shell release CSP');
+assertExactCspDirective(devCsp, 'script-src', ["'self'"], 'desktop shell dev CSP');
+
 const allowedPermissions = [
   'allow-host-bridge-request',
 ];