Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

vite-ssg 生成 inline script 产生的问题 #49

Open
tshemeng opened this issue Jun 2, 2021 · 3 comments · May be fixed by #67
Open

vite-ssg 生成 inline script 产生的问题 #49

tshemeng opened this issue Jun 2, 2021 · 3 comments · May be fixed by #67
Labels
pr welcome

Comments

@tshemeng
Copy link
Contributor

tshemeng commented Jun 2, 2021

我使用vite-ssg生成.html，然后打包为浏览器扩展，在feat: Add Initial State这个commit之后，vite-ssg会在生成的.html文件末尾插入一段inline script，这会触发浏览器CSP错误，因为浏览器认为扩展中存在inline script是不安全的，是否可以添加选项选择是否启用这个特性呢

<script>window.__INITIAL_STATE__ = "{}"</script>
@antfu
Copy link
Member

antfu commented Jun 2, 2021

Yeah, PR welcome! /cc @pantajoe

BTW, @tshemeng it will be great if you can use English next time, so ppl could help and discuss easier

@pantajoe
Copy link
Contributor

I have much on my plate right now, but I guess I can do it in the next few weeks if no one does it before me 😄 Just an idea: Maybe it's a good idea not to inline this into the app.html, but rather as an additional initial-state.js script that is required on every generated page?
This way, we do not a feature flag for this.

@pantajoe pantajoe linked a pull request Jul 10, 2021 that will close this issue
Open
@pantajoe
Copy link
Contributor

@antfu @tshemeng I created a PR #67. It extracts the initialState script to an asset file and avoid the inline script. As I mentioned earlier, this should both prevent a feature flag to toggle the initialState feature and respect CSP.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
pr welcome
Projects
None yet
Milestone
No milestone
Development

Successfully merging a pull request may close this issue.

feat: Extract initialState to asset to respect CSP pantajoe/vite-ssg
3 participants
@tshemeng @antfu @pantajoe