feat: support strict CSP (follow-up to #1193)#1240
Open
Conversation
Resolve conflicts in: - packages/dockview-core/src/dockview/options.ts (kept both new imports from master and the CspNonce import from this branch) - __generated__/dockview-core-exports.txt (regenerated via npm run gen) Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
… in addStyles When a stylesheet has an href, addStyles already appends a <link> to the target document. Previously it then also fell through and tried to read cssRules to inject inline <style> elements for the same sheet, which both duplicates the rules (same-origin sheets) and logs a security warning (cross-origin sheets). Continue past the inline-injection block once the <link> has been appended. Also runs prettier on dom.ts and dom.spec.ts to satisfy format:check. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Add three integration tests around PopoutWindow.open() that mock window.open and verify the nonce option flows all the way into the <style> elements injected into the popout document, both for string nonces and for the (targetDocument) => string callback form. Also adds a small contract test asserting that 'nonce' is in PROPERTY_KEYS_DOCKVIEW, which is what makes the React and Vue wrappers auto-forward the option without explicit prop wiring. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Builds on @hyperNURb's #1193 (preserves all original commits/authorship) and addresses the items blocking that PR.
What this PR adds on top of #1193
packages/dockview-core/src/dockview/options.tsimports +__generated__/dockview-core-exports.txt). Brings in the unrelatedReactComponentBridgetest-flake fix (ce02eea24) so CI'stestjob stops failing.fix(dockview-core): avoid duplicating rules from external stylesheets —addStylespreviously appended a<link>for href-bearing sheets and fell through to inject inline<style>elements for the same sheet, which both duplicates rules (same-origin sheets) and triggers the security-warning path (cross-origin sheets). Flagged by the Copilot review on feat: support strict CSP #1193. Now wecontinuepast the inline-injection block once the<link>has been appended, and the existing test is tightened to assert no<style>is produced for an href sheet.dom.tsanddom.spec.tssoformat:checkpasses.test(dockview-core): cover CSP nonce wiring —popoutWindow.spec.ts(3 tests) drivesPopoutWindow.open()with a mockedwindow.openand verifies the nonce option flows throughaddStylesinto the<style>elements in the popout document, for both string and(targetDocument) => stringforms.options.spec.tsasserts'nonce' ∈ PROPERTY_KEYS_DOCKVIEW, which is the contract that lets the React and Vue wrappers auto-forward the option without explicit prop wiring (validates the description's claim that React/Vue are covered).Test plan
yarn nx run dockview-core:format:check— cleanyarn nx run dockview-core:lint— 0 errorsyarn nx run dockview-core:test— 867/867 pass (+14 from new tests)addStylestest would have caught the duplicate-rules bug (checked by reverting thecontinuelocally —<style>length goes from 0 → 1)🤖 Generated with Claude Code