From 50c5404053ce7d4dea874faaf77035ed9cc6b0c0 Mon Sep 17 00:00:00 2001
From: kdletters <kdletters@qq.com>
Date: Sun, 21 Jun 2026 19:53:45 +0800
Subject: [PATCH] =?UTF-8?q?=E6=94=B6=E7=B4=A7=E6=A1=8C=E9=9D=A2=E5=A3=B3?=
 =?UTF-8?q?=E8=84=9A=E6=9C=AC=20CSP=20=E9=97=A8=E7=A6=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

校验 release CSP 的 script-src 只能为 self

校验 dev CSP 的 script-src 只能为 self

避免脚本 CSP 通过追加 inline 来源静默放宽
---
 apps/desktop-shell/scripts/check-config.mjs | 30 +++++++++++++++++++++
 1 file changed, 30 insertions(+)

diff --git a/apps/desktop-shell/scripts/check-config.mjs b/apps/desktop-shell/scripts/check-config.mjs
index 1dc6062e0..fe29a5e15 100644
--- a/apps/desktop-shell/scripts/check-config.mjs
+++ b/apps/desktop-shell/scripts/check-config.mjs
@@ -637,6 +637,33 @@ function pathRelative(fromPath, toPath) {
     .replace(/\/$/, '');
 }
 
+function cspDirectiveValues(source, directiveName) {
+  const directive = source
+    .split(';')
+    .map((entry) => entry.trim())
+    .find((entry) => entry.startsWith(`${directiveName} `));
+  if (!directive) {
+    return [];
+  }
+
+  return directive
+    .split(/\s+/)
+    .slice(1)
+    .filter(Boolean);
+}
+
+function assertExactCspDirective(source, directiveName, expectedValues, label) {
+  const actualValues = cspDirectiveValues(source, directiveName);
+  if (
+    actualValues.length !== expectedValues.length ||
+    expectedValues.some((value, index) => actualValues[index] !== value)
+  ) {
+    throw new Error(
+      `${label} ${directiveName} must be ${[directiveName, ...expectedValues].join(' ')}`,
+    );
+  }
+}
+
 const productionSourceFiles = productionSourceRoots.flatMap((root) =>
   collectProductionSourceFiles(root),
 );
@@ -2429,6 +2456,9 @@ for (const requiredDevCspToken of [
   }
 }
 
+assertExactCspDirective(csp, 'script-src', ["'self'"], 'desktop shell release CSP');
+assertExactCspDirective(devCsp, 'script-src', ["'self'"], 'desktop shell dev CSP');
+
 const allowedPermissions = [
   'allow-host-bridge-request',
 ];