mirror of
https://github.com/discourse/discourse.git
synced 2026-08-08 17:53:55 +08:00
a32f09021f- Add new `discourse/app/workers/...` directory - Adds a custom rolldown plugin which can create a dynamic entrypoint and return a digested URL for it - Update media-optimization service to use this new rolldown interface, and launch the worker via a `blob:` - Updates media-optimization to use type:module worker, and improve boot-error-handling strategy This is an improvement for a few reasons: 1. We can drop all the manual entrypoint/manifest/ruby config which was used to obtain the media-optimization bundle URL 2. We don't need to serve the worker from the (undigested/uncached) `public/` directory on the forum domain. Instead we just generate a one-liner worker entrypoint and create a blob from it 3. Since we're launching from a blob, the worker inherits the CSP of the host document, which is a nice defense-in-depth improvement
19 lines
624 B
Ruby
Vendored
19 lines
624 B
Ruby
Vendored
# frozen_string_literal: true
|
|
|
|
RSpec.describe "content security policy integration" do
|
|
it "adds the csp headers correctly" do
|
|
Fabricate(:admin) # to avoid 'new installation' screen
|
|
|
|
SiteSetting.content_security_policy = false
|
|
get "/"
|
|
expect(response.headers["Content-Security-Policy"]).to eq(nil)
|
|
|
|
SiteSetting.content_security_policy = true
|
|
get "/"
|
|
expect(response.headers["Content-Security-Policy"]).to be_present
|
|
|
|
expect(response.headers["Content-Security-Policy"]).to match(
|
|
/script-src 'nonce-[^']+' 'strict-dynamic' 'wasm-unsafe-eval'; worker-src 'self' blob:;/,
|
|
)
|
|
end
|
|
end
|
