MetaZone/MetaLab
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: 放宽 CSP 允许 esm.sh CDN 加载 CodeMirror 6 ESM 模块

Browse Source 
- script-src 添加 https://esm.sh，允许 CodeMirror 6 的 ESM import 加载
- connect-src 显式设为 self，确保 Markdown 预览 fetch 请求正常
- img-src 添加 blob:，支持粘贴图片场景
This commit is contained in:
Victor Jay
2026-05-27 19:44:59 +08:00
parent cc527aaf19
commit 799ac3c95c
3 changed files with 20 additions and 33 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
internal/middleware/security.go
View File

@ -8,10 +8,16 @@ import (
// 作为纵深防御，不影响业务逻辑，纯附加
func SecurityHeaders() gin.HandlerFunc {
return func(c *gin.Context) {
// Content-Security-Policy：仅允许本站资源 + 内联样式/脚本
// img-src 允许 data: URI 用于头像裁切预览等场景
// Content-Security-Policy
// script-src: 本站 + esm.sh CDN (CodeMirror 6 ESM 模块)
// connect-src: 本站 (Markdown 预览等 fetch 请求)
// img-src: 本站 + data: URI (头像裁切) + blob: (粘贴图片)
c.Header("Content-Security-Policy",
"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' data:")
"default-src 'self'; "+
"script-src 'self' 'unsafe-inline' https://esm.sh; "+
"style-src 'self' 'unsafe-inline'; "+
"img-src 'self' data: blob:; "+
"connect-src 'self'")
// 禁止 MIME 类型嗅探
c.Header("X-Content-Type-Options", "nosniff")

23
templates/MetaLab-2026/html/posts/new.html
View File

@ -124,27 +124,6 @@
{{template "layout/footer.html" .}}
{{/* CodeMirror 6 import map (MIT License, from jsdelivr CDN) */}}
<script type="importmap">
{
"imports": {
"@codemirror/state": "https://cdn.jsdelivr.net/npm/@codemirror/state@6.5.2/dist/index.js",
"@codemirror/view": "https://cdn.jsdelivr.net/npm/@codemirror/view@6.36.4/dist/index.js",
"@codemirror/commands": "https://cdn.jsdelivr.net/npm/@codemirror/commands@6.8.1/dist/index.js",
"@codemirror/language": "https://cdn.jsdelivr.net/npm/@codemirror/language@6.11.0/dist/index.js",
"@codemirror/lang-markdown": "https://cdn.jsdelivr.net/npm/@codemirror/lang-markdown@6.3.2/dist/index.js",
"@codemirror/language-data": "https://cdn.jsdelivr.net/npm/@codemirror/language-data@6.5.1/dist/index.js",
"@codemirror/autocomplete": "https://cdn.jsdelivr.net/npm/@codemirror/autocomplete@6.18.6/dist/index.js",
"@codemirror/search": "https://cdn.jsdelivr.net/npm/@codemirror/search@6.5.10/dist/index.js",
"@lezer/common": "https://cdn.jsdelivr.net/npm/@lezer/common@1.2.3/dist/index.js",
"@lezer/highlight": "https://cdn.jsdelivr.net/npm/@lezer/highlight@1.2.1/dist/index.js",
"@lezer/lr": "https://cdn.jsdelivr.net/npm/@lezer/lr@1.4.2/dist/index.js",
"@lezer/markdown": "https://cdn.jsdelivr.net/npm/@lezer/markdown@1.4.0/dist/index.js",
"crelt": "https://cdn.jsdelivr.net/npm/crelt@1.0.6/index.js",
"style-mod": "https://cdn.jsdelivr.net/npm/style-mod@4.1.2/src/style-mod.js",
"w3c-keyname": "https://cdn.jsdelivr.net/npm/w3c-keyname@2.2.8/index.js"
}
}
</script>
{{/* CodeMirror 6 (MIT License, via esm.sh bundle) */}}
<script src="/static/js/common.js"></script>
<script type="module" src="/static/js/editor.js"></script>

18
templates/MetaLab-2026/static/js/editor.js
View File

@ -12,15 +12,17 @@
* - 字数/行数/阅读时间统计
* - 全屏编辑模式（F11）
* - 滚动同步（分屏模式下）
*
* CodeMirror 6 通过 esm.sh bundle 加载，所有依赖自动解析。
*/
import { EditorState } from '@codemirror/state';
import { EditorView, keymap, lineNumbers, highlightActiveLine, drawSelection } from '@codemirror/view';
import { defaultKeymap, history, historyKeymap, indentWithTab } from '@codemirror/commands';
import { markdown, markdownLanguage } from '@codemirror/lang-markdown';
import { languages } from '@codemirror/language-data';
import { syntaxHighlighting, defaultHighlightStyle } from '@codemirror/language';
import { searchKeymap } from '@codemirror/search';
import { autocompletion } from '@codemirror/autocomplete';
import { EditorState } from 'https://esm.sh/@codemirror/state@6.5.2';
import { EditorView, keymap, lineNumbers, highlightActiveLine, drawSelection } from 'https://esm.sh/@codemirror/view@6.36.4';
import { defaultKeymap, history, historyKeymap, indentWithTab } from 'https://esm.sh/@codemirror/commands@6.8.1';
import { markdown, markdownLanguage } from 'https://esm.sh/@codemirror/lang-markdown@6.3.2';
import { languages } from 'https://esm.sh/@codemirror/language-data@6.5.1';
import { syntaxHighlighting, defaultHighlightStyle } from 'https://esm.sh/@codemirror/language@6.11.0';
import { searchKeymap } from 'https://esm.sh/@codemirror/search@6.5.10';
import { autocompletion } from 'https://esm.sh/@codemirror/autocomplete@6.18.6';
/* ================================================================
DOM 引用