till/managarten
1
0
Fork 0
mirror of https://github.com/Memo-2023/mana-monorepo.git synced 2026-05-14 19:41:09 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions 4

fix(csp): allow wasm-unsafe-eval so @mana/local-llm can instantiate WebLLM

Browse source 
WebAssembly.instantiate() was blocked by script-src on every app using
shared security headers. 'wasm-unsafe-eval' is the narrow CSP source
that whitelists WASM compilation only — it does NOT re-enable eval() or
new Function(). Required by the MLC WebGPU runtime that powers the
in-browser Qwen models on /llm-test.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
Till JS 2026-04-08 18:05:30 +02:00
parent 01632dfa49
commit 624f5ce00b
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
packages/shared-utils/src/security-headers.ts
View file

@ -61,7 +61,11 @@ export function setSecurityHeaders(response: Response, options: SecurityHeadersO
// Content Security Policy
const cspDirectives = [
"default-src 'self'",
`script-src 'self' 'unsafe-inline' https://stats.mana.how https://glitchtip.mana.how ${scriptSrc.join(' ')}`.trim(),
// 'wasm-unsafe-eval' is required by @mana/local-llm (WebLLM) to
// instantiate the MLC WebGPU runtime. It only permits WebAssembly
// compilation, NOT eval()/new Function() — much narrower than the
// legacy 'unsafe-eval' source. Supported by all evergreen browsers.
`script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' https://stats.mana.how https://glitchtip.mana.how ${scriptSrc.join(' ')}`.trim(),
"style-src 'self' 'unsafe-inline'",
`img-src 'self' data: blob: https: ${imgSrc.join(' ')}`.trim(),
`connect-src 'self' https://stats.mana.how https://glitchtip.mana.how ${connectSrc.join(' ')}`.trim(),