From 94fead087371125e8f5498256ae5c3e86d208d4c Mon Sep 17 00:00:00 2001 From: Till JS Date: Mon, 23 Mar 2026 10:04:25 +0100 Subject: [PATCH] fix(mukke): add unsafe-eval to CSP for Butterchurn shader compilation Butterchurn (Milkdrop) uses eval() for preset/shader compilation which was blocked by CSP. Add unsafe-eval to script-src for mukke only. Co-Authored-By: Claude Opus 4.6 (1M context) --- apps/mukke/apps/web/src/hooks.server.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/apps/mukke/apps/web/src/hooks.server.ts b/apps/mukke/apps/web/src/hooks.server.ts index 102c1e8a6..d04eb0a43 100644 --- a/apps/mukke/apps/web/src/hooks.server.ts +++ b/apps/mukke/apps/web/src/hooks.server.ts @@ -34,6 +34,8 @@ window.__PUBLIC_GLITCHTIP_DSN__ = "${PUBLIC_GLITCHTIP_DSN}"; connectSrc: [PUBLIC_MANA_CORE_AUTH_URL_CLIENT, PUBLIC_BACKEND_URL_CLIENT, S3_PUBLIC_ENDPOINT], mediaSrc: [S3_PUBLIC_ENDPOINT, 'blob:'], imgSrc: [S3_PUBLIC_ENDPOINT], + // Butterchurn (Milkdrop) uses eval() for shader/preset compilation + scriptSrc: ["'unsafe-eval'"], }); return response;