From 3d6b1188e47e63f5c8307d8538072a5cfb6bccb0 Mon Sep 17 00:00:00 2001
From: Suradet Pratomsak <pharmacistsabot@gmail.com>
Date: Wed, 5 Aug 2026 09:45:07 +0700
Subject: [PATCH 1/2] fix: add wasm-unsafe-eval to CSP script-src
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

WebAssembly.instantiateStreaming() requires 'wasm-unsafe-eval' in
the CSP. This is more restrictive than 'unsafe-eval' — it only
permits WASM compilation, not arbitrary eval().
---
 SECURITY.md | 11 ++++++-----
 vercel.json |  2 +-
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/SECURITY.md b/SECURITY.md
index b6d95b5..cbc415f 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -69,7 +69,7 @@ CSP directives enforced:
 
 ```
 default-src 'none';
-script-src 'self' 'unsafe-inline';
+script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';
 style-src 'self' 'unsafe-inline';
 img-src 'self' blob:;
 font-src 'self';
@@ -82,10 +82,11 @@ No `unsafe-eval`. The `unsafe-inline` for styles is required by Leptos's
 CSR rendering. The `unsafe-inline` for scripts is required because Trunk
 generates an inline `<script type="module">` to bootstrap WASM — its
 content (including hashed filenames) changes per build, making a static
-SHA-256 hash non-viable. This is a known limitation; a post-build
-extraction step would be needed to eliminate it. CI enforces that the
-CSP header is present and valid via the `csp-verify` job in
-`.github/workflows/ci.yml`.
+SHA-256 hash non-viable. The `wasm-unsafe-eval` is required because
+WebAssembly.instantiateStreaming() needs it; this is more restrictive
+than `unsafe-eval` — it only permits WASM compilation, not arbitrary
+`eval()`. CI enforces that the CSP header is present and valid via the
+`csp-verify` job in `.github/workflows/ci.yml`.
 
 ---
 
diff --git a/vercel.json b/vercel.json
index cf33b2f..ddd1f44 100644
--- a/vercel.json
+++ b/vercel.json
@@ -9,7 +9,7 @@
     {
       "source": "/(.*)",
       "headers": [
-        { "key": "Content-Security-Policy", "value": "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'" },
+        { "key": "Content-Security-Policy", "value": "default-src 'none'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'" },
         { "key": "X-Content-Type-Options", "value": "nosniff" },
         { "key": "X-Frame-Options", "value": "DENY" },
         { "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },

From e8b9ebf4e8de8108f149d969d2e61839c52188f7 Mon Sep 17 00:00:00 2001
From: Suradet Pratomsak <pharmacistsabot@gmail.com>
Date: Wed, 5 Aug 2026 09:49:25 +0700
Subject: [PATCH 2/2] ci: fix CSP verify - exclude wasm-unsafe-eval from
 unsafe-eval check

grep was matching 'wasm-unsafe-eval' as a false positive. Now
sed strips 'wasm-unsafe-eval' before checking for 'unsafe-eval'.
---
 .github/workflows/ci.yml | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 67731d7..3136db9 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -161,7 +161,8 @@ jobs:
           done
 
           # Deny dangerous directives
-          if echo "$csp" | grep -q "unsafe-eval"; then
+          # Remove 'wasm-unsafe-eval' before checking to avoid false positive
+          if echo "$csp" | sed "s/wasm-unsafe-eval//g" | grep -q "unsafe-eval"; then
             echo "::error::CSP must not contain 'unsafe-eval'"
             exit 1
           fi