Add wasm-unsafe-eval to CSP directives

manisandro · manisandro · commit 14b5fbdd3015 · 2025-10-30T10:59:18.000+01:00
Needed for importing certain 3D tiles
diff --git a/src/qwc2_viewer.py b/src/qwc2_viewer.py
@@ -211,7 +211,7 @@ def qwc2_index(self, identity, params, request_url):
         # Inject CSP header and modify script tags
         nonce = secrets.token_urlsafe()
         csp = {
-            "script-src": "'nonce-%s' 'strict-dynamic'" % nonce,
+            "script-src": "'nonce-%s' 'strict-dynamic' 'wasm-unsafe-eval'" % nonce,
             # "style-src 'nonce-%s'" % nonce # TODO
         }
         for extra_csp in filter(bool, self.extra_csp_directives.split(";")):

Original file line number	Diff line number	Diff line change
`@@ -211,7 +211,7 @@ def qwc2_index(self, identity, params, request_url):`
`211`	`211`	`# Inject CSP header and modify script tags`
`212`	`212`	`nonce = secrets.token_urlsafe()`
`213`	`213`	`csp = {`
`214`		`- "script-src": "'nonce-%s' 'strict-dynamic'" % nonce,`
	`214`	`+ "script-src": "'nonce-%s' 'strict-dynamic' 'wasm-unsafe-eval'" % nonce,`
`215`	`215`	`# "style-src 'nonce-%s'" % nonce # TODO`
`216`	`216`	`}`
`217`	`217`	`for extra_csp in filter(bool, self.extra_csp_directives.split(";")):`