Skip to content

Fix: add wasm-unsafe-eval to CSP for WebAssembly #21

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
suradet-ps merged 2 commits into from
Aug 5, 2026
Merged

Fix: add wasm-unsafe-eval to CSP for WebAssembly #21

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3d6b118
fix: add wasm-unsafe-eval to CSP script-src
suradet-ps Aug 5, 2026
e8b9ebf
ci: fix CSP verify - exclude wasm-unsafe-eval from unsafe-eval check
suradet-ps Aug 5, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 2 additions & 1 deletion .github/workflows/ci.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,7 +161,8 @@ jobs:
done

# Deny dangerous directives
if echo "$csp" | grep -q "unsafe-eval"; then
# Remove 'wasm-unsafe-eval' before checking to avoid false positive
if echo "$csp" | sed "s/wasm-unsafe-eval//g" | grep -q "unsafe-eval"; then
echo "::error::CSP must not contain 'unsafe-eval'"
exit 1
fi
Expand Down
11 changes: 6 additions & 5 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -69,7 +69,7 @@ CSP directives enforced:

```
default-src 'none';
script-src 'self' 'unsafe-inline';
script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval';
style-src 'self' 'unsafe-inline';
img-src 'self' blob:;
font-src 'self';
Expand All @@ -82,10 +82,11 @@ No `unsafe-eval`. The `unsafe-inline` for styles is required by Leptos's
CSR rendering. The `unsafe-inline` for scripts is required because Trunk
generates an inline `<script type="module">` to bootstrap WASM — its
content (including hashed filenames) changes per build, making a static
SHA-256 hash non-viable. This is a known limitation; a post-build
extraction step would be needed to eliminate it. CI enforces that the
CSP header is present and valid via the `csp-verify` job in
`.github/workflows/ci.yml`.
SHA-256 hash non-viable. The `wasm-unsafe-eval` is required because
WebAssembly.instantiateStreaming() needs it; this is more restrictive
than `unsafe-eval` — it only permits WASM compilation, not arbitrary
`eval()`. CI enforces that the CSP header is present and valid via the
`csp-verify` job in `.github/workflows/ci.yml`.

---

Expand Down
2 changes: 1 addition & 1 deletion vercel.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@
{
"source": "/(.*)",
"headers": [
{ "key": "Content-Security-Policy", "value": "default-src 'none'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'" },
{ "key": "Content-Security-Policy", "value": "default-src 'none'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' blob:; font-src 'self'; connect-src 'self'; worker-src 'self'; manifest-src 'self'" },
{ "key": "X-Content-Type-Options", "value": "nosniff" },
{ "key": "X-Frame-Options", "value": "DENY" },
{ "key": "Referrer-Policy", "value": "strict-origin-when-cross-origin" },
Expand Down
Loading