Skip to content

fix csp issue for mts realm#1998

Merged
PupilTong merged 1 commit intolynx-family:mainfrom
PupilTong:p/hw/fix-csp-2
Dec 15, 2025
Merged

fix csp issue for mts realm#1998
PupilTong merged 1 commit intolynx-family:mainfrom
PupilTong:p/hw/fix-csp-2

Conversation

@PupilTong
Copy link
Copy Markdown
Collaborator

@PupilTong PupilTong commented Dec 15, 2025 •
edited by coderabbitai bot
Loading

Summary by CodeRabbit

Bug Fixes

  • Fixed Content Security Policy (CSP) nonce handling in iframe scripts to ensure proper compliance with security policies.
  • Nonce values are now correctly applied to all inline and dynamically loaded scripts, improving CSP compatibility and security robustness.

✏️ Tip: You can customize this high-level summary in your review settings.

Checklist

  • Tests updated (or not required).
  • Documentation updated (or not required).
  • Changeset added, and when a BREAKING CHANGE occurs, it needs to be clearly marked (or not required).

@PupilTong PupilTong self-assigned this Dec 15, 2025
@changeset-bot
Copy link
Copy Markdown

changeset-bot bot commented Dec 15, 2025

🦋 Changeset detected

Latest commit: 80a0381

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 10 packages
Name Type
@lynx-js/web-core Patch
upgrade-rspeedy Patch
@lynx-js/web-rsbuild-server-middleware Patch
@lynx-js/web-core-server Patch
@lynx-js/web-constants Patch
@lynx-js/web-mainthread-apis Patch
@lynx-js/web-worker-rpc Patch
@lynx-js/web-worker-runtime Patch
@lynx-js/rspeedy Patch
create-rspeedy Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Dec 15, 2025 •
edited
Loading

📝 Walkthrough

Walkthrough

Added a changeset entry documenting a patch release for @lynx-js/web-core. Modified the iframe script injection logic in createRenderAllOnUI.ts to assign Content Security Policy (CSP) nonce attributes to inline and dynamically created scripts to ensure CSP compliance.

Changes

Cohort / File(s) Summary
Release metadata
.changeset/thin-streets-rule.md		 Added changeset file documenting patch release for @lynx-js/web-core with CSP nonce fix note
CSP nonce handling
packages/web-platform/web-core/src/uiThread/createRenderAllOnUI.ts		 Normalizes nonce to safe default string value; injects nonce into iframe's inline readiness signal script; applies nonce to dynamically created scripts (loadScript and loadScriptSync paths); adds nonce assignment for XHR-sourced scripts before appending to iframe

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~25 minutes

  • CSP nonce propagation affects multiple script injection paths; verify nonce is consistently applied across inline scripts, dynamic loads, and XHR-sourced content
  • Confirm undefined/null nonce handling produces correct empty string default and doesn't break CSP attribute generation
  • Review interaction with existing iframe sandbox and script loading mechanisms to ensure compatibility with related PRs

Possibly related PRs

Suggested labels

platform:Web

Suggested reviewers

  • Sherry-hue
  • colinaaa

Poem

🐰 A nonce here, a nonce there,
In every iframe script with care!
CSP's rules we now obey,
Hopping safely, come what may~
✨🛡️

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)
Check name Status Explanation
Title check ✅ Passed The title 'fix csp issue for mts realm' directly relates to the main changes in the PR, which involve fixing CSP (Content Security Policy) compatibility by adding nonce support to the MTS realm.
Docstring Coverage ✅ Passed Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%.
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
✨ Finishing touches
  • 📝 Generate docstrings
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Post copyable unit tests in a comment

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

@codecov
Copy link
Copy Markdown

codecov bot commented Dec 15, 2025 •
edited
Loading

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ All tests successful. No failed tests found.

📢 Thoughts on this report? Let us know!

@codspeed-hq
Copy link
Copy Markdown

codspeed-hq bot commented Dec 15, 2025

CodSpeed Performance Report

Merging #1998 will not alter performance

Comparing PupilTong:p/hw/fix-csp-2 (80a0381) with main (4e17b0b)

Summary

✅ 63 untouched
⏩ 3 skipped1

Footnotes

  1. 3 benchmarks were skipped, so the baseline results were used instead. If they were deleted from the codebase, click here and archive them to remove them from the performance reports. ↩

@relativeci
Copy link
Copy Markdown

relativeci bot commented Dec 15, 2025 •
edited
Loading

React Example

#6470 Bundle Size — 236.9KiB (0%).

80a0381(current) vs 4e17b0b main#6456(baseline)

Bundle metrics  no changes
                 Current
#6470		      Baseline
#6456
No change  Initial JS 0B 0B
No change  Initial CSS 0B 0B
No change  Cache Invalidation 0% 0%
No change  Chunks 0 0
No change  Assets 4 4
No change  Modules 162 162
No change  Duplicate Modules 65 65
No change  Duplicate Code 46.74% 46.74%
No change  Packages 2 2
No change  Duplicate Packages 0 0
Bundle size by type  no changes
                 Current
#6470		      Baseline
#6456
No change  IMG 145.76KiB 145.76KiB
No change  Other 91.14KiB 91.14KiB

Bundle analysis report Branch PupilTong:p/hw/fix-csp-2 Project dashboard

Generated by RelativeCI Documentation Report issue

@relativeci
Copy link
Copy Markdown

relativeci bot commented Dec 15, 2025 •
edited
Loading

Web Explorer

#6630 Bundle Size — 372.5KiB (~+0.01%).

80a0381(current) vs 4e17b0b main#6616(baseline)

Bundle metrics  Change 3 changes Regression 1 regression
                 Current
#6630		      Baseline
#6616
Regression  Initial JS 146.23KiB(+0.01%) 146.21KiB
No change  Initial CSS 32.4KiB 32.4KiB
Change  Cache Invalidation 39.25% 0%
No change  Chunks 8 8
No change  Assets 8 8
Change  Modules 231(+0.43%) 230
No change  Duplicate Modules 16 16
No change  Duplicate Code 2.97% 2.97%
No change  Packages 4 4
No change  Duplicate Packages 0 0
Bundle size by type  Change 1 change Regression 1 regression
                 Current
#6630		      Baseline
#6616
Regression  JS 243.12KiB (~+0.01%) 243.1KiB
No change  Other 96.98KiB 96.98KiB
No change  CSS 32.4KiB 32.4KiB

Bundle analysis report Branch PupilTong:p/hw/fix-csp-2 Project dashboard

Generated by RelativeCI Documentation Report issue

@PupilTong PupilTong requested a review from Sherry-hue December 15, 2025 11:59
@PupilTong PupilTong merged commit 6a1a5d3 into lynx-family:main Dec 15, 2025
82 of 85 checks passed
@github-actions github-actions bot mentioned this pull request Dec 15, 2025
Merged
luhc228 pushed a commit to luhc228/lynx-stack that referenced this pull request Dec 16, 2025
@PupilTong @luhc228
fix csp issue for mts realm (lynx-family#1998)
a9822d9
@coderabbitai coderabbitai bot mentioned this pull request Dec 16, 2025
Merged
3 tasks
f0rdream pushed a commit to f0rdream/lynx-stack that referenced this pull request Dec 18, 2025
@PupilTong @f0rdream
fix csp issue for mts realm (lynx-family#1998)
2928a70
colinaaa pushed a commit that referenced this pull request Dec 22, 2025
@github-actions
chore: Release 2025-12-22 04:06:36 (#1999)
8b2f07e 
This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to main, this PR will
be updated.


# Releases
## @lynx-js/gesture-runtime@2.1.0

### Minor Changes

- Initialize `'@lynx-js/gesture-runtime`
([#1984](#1984))

## @lynx-js/rspeedy@0.12.3

### Patch Changes

- Support environment variants to enable multiple configurations for the
same targets.
([#1969](#1969))

-   Updated dependencies \[]:
    -   @lynx-js/web-rsbuild-server-middleware@0.19.2

## @lynx-js/lynx-bundle-rslib-config@0.0.2

### Patch Changes

- Introduce `@lynx-js/externals-loading-webpack-plugin`. It will help
you to load externals built by `@lynx-js/lynx-bundle-rslib-config`.
([#1924](#1924))

    ```js
    // webpack.config.js
import { ExternalsLoadingPlugin } from
"@lynx-js/externals-loading-webpack-plugin";

    export default {
      plugins: [
        new ExternalsLoadingPlugin({
          mainThreadLayer: "main-thread",
          backgroundLayer: "background",
          externals: {
            lodash: {
              url: "http://lodash.lynx.bundle",
              background: { sectionPath: "background" },
              mainThread: { sectionPath: "main-thread" },
            },
          },
        }),
      ],
    };
    ```

## @lynx-js/react-rsbuild-plugin@0.12.2

### Patch Changes

- Support environment variants to enable multiple configurations for the
same targets.
([#1969](#1969))

-   Updated dependencies \[]:
    -   @lynx-js/react-alias-rsbuild-plugin@0.12.2

## @lynx-js/web-constants@0.19.2

### Patch Changes

-   Updated dependencies \[]:
    -   @lynx-js/web-worker-rpc@0.19.2

## @lynx-js/web-core@0.19.2

### Patch Changes

- chore: mark the "multi-thread" deprecated
([#2030](#2030))

    **NOTICE This will be a breaking change in the future**

    mark the thread strategy "multi-thread" as deprecated.

Please use "all-on-ui" instead. If you still want to use multi-thread
mode, please try to use a cross-origin isolated iframe.

A console warning will be printed if `thread-strategy` is set to
`multi-thread`.

- fix csp issue for mts realm
([#1998](#1998))

-   Updated dependencies \[]:
    -   @lynx-js/web-constants@0.19.2
    -   @lynx-js/web-mainthread-apis@0.19.2
    -   @lynx-js/web-worker-rpc@0.19.2
    -   @lynx-js/web-worker-runtime@0.19.2

## @lynx-js/web-explorer@0.0.15

### Patch Changes

- fix: web-explorer needs to actively send an iframeReady message to the
parent, the parent uses `iframe load` listener cannot guarantee that the
`message-listener` will complete execution.
([#2001](#2001))

## @lynx-js/web-mainthread-apis@0.19.2

### Patch Changes

-   Updated dependencies \[]:
    -   @lynx-js/web-constants@0.19.2

## @lynx-js/web-worker-runtime@0.19.2

### Patch Changes

-   Updated dependencies \[]:
    -   @lynx-js/web-constants@0.19.2
    -   @lynx-js/web-mainthread-apis@0.19.2
    -   @lynx-js/web-worker-rpc@0.19.2

## @lynx-js/externals-loading-webpack-plugin@0.0.1

### Patch Changes

- Introduce `@lynx-js/externals-loading-webpack-plugin`. It will help
you to load externals built by `@lynx-js/lynx-bundle-rslib-config`.
([#1924](#1924))

    ```js
    // webpack.config.js
import { ExternalsLoadingPlugin } from
"@lynx-js/externals-loading-webpack-plugin";

    export default {
      plugins: [
        new ExternalsLoadingPlugin({
          mainThreadLayer: "main-thread",
          backgroundLayer: "background",
          externals: {
            lodash: {
              url: "http://lodash.lynx.bundle",
              background: { sectionPath: "background" },
              mainThread: { sectionPath: "main-thread" },
            },
          },
        }),
      ],
    };
    ```

## create-rspeedy@0.12.3



## @lynx-js/react-alias-rsbuild-plugin@0.12.2



## upgrade-rspeedy@0.12.3



## @lynx-js/web-core-server@0.19.2



## @lynx-js/web-rsbuild-server-middleware@0.19.2



## @lynx-js/web-worker-rpc@0.19.2

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Sherry-hue Sherry-hue Sherry-hue approved these changes

Assignees

@PupilTong PupilTong

Labels

platform:Web

Projects

Lynx for Web
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@PupilTong @Sherry-hue