Repository: Y2Z/monolith
Pull request #292 (2021-12-06 06:09:55)

Include unsafe-eval origin for isolated documents
Some websites require this in order to let its JS operate.


Patch:
diff --git a/README.md b/README.md
index 00443a6..ff57b3d 100644
--- a/README.md
+++ b/README.md
@@ -42,6 +42,12 @@ brew install monolith
 sudo port install monolith
 ```
 
+#### Via [MacPorts](https://ports.macports.org/port/monolith/summary) (macOS)
+
+```console
+sudo port install monolith
+```
+
 #### Using [Snapcraft](https://snapcraft.io/monolith) (GNU/Linux)
 
 ```console
diff --git a/src/html.rs b/src/html.rs
index 36654ea..52075b9 100644
--- a/src/html.rs
+++ b/src/html.rs
@@ -83,7 +83,7 @@ pub fn compose_csp(options: &Options) -> String {
     let mut string_list = vec![];
 
     if options.isolate {
-        string_list.push("default-src 'unsafe-inline' data:;");
+        string_list.push("default-src 'unsafe-eval' 'unsafe-inline' data:;");
     }
 
     if options.no_css {


Test patch:
diff --git a/tests/cli/data_url.rs b/tests/cli/data_url.rs
index 9c65a53..9bdc3fc 100644
--- a/tests/cli/data_url.rs
+++ b/tests/cli/data_url.rs
@@ -30,7 +30,7 @@ mod passing {
         assert_eq!(
             String::from_utf8_lossy(&out.stdout),
             "<html><head>\
-            <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-inline' data:;\"></meta>\
+            <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-eval' 'unsafe-inline' data:;\"></meta>\
             </head><body>Hello, World!</body></html>\n"
         );
 
diff --git a/tests/cli/local_files.rs b/tests/cli/local_files.rs
index f1fb39f..fbdc7e9 100644
--- a/tests/cli/local_files.rs
+++ b/tests/cli/local_files.rs
@@ -98,7 +98,7 @@ mod passing {
             format!(
                 "\
                 <!DOCTYPE html><html lang=\"en\"><head>\
-                <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-inline' data:; style-src 'none'; script-src 'none'; img-src data:;\"></meta>\n  \
+                <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-eval' 'unsafe-inline' data:; style-src 'none'; script-src 'none'; img-src data:;\"></meta>\n  \
                 <meta http-equiv=\"Content-Type\" content=\"text/html; charset=utf-8\">\n  \
                 <title>Local HTML file</title>\n  \
                 <link rel=\"stylesheet\" type=\"text/css\">\n  \
diff --git a/tests/html/compose_csp.rs b/tests/html/compose_csp.rs
index ae3e7a4..acd291c 100644
--- a/tests/html/compose_csp.rs
+++ b/tests/html/compose_csp.rs
@@ -16,7 +16,10 @@ mod passing {
         options.isolate = true;
         let csp_content = html::compose_csp(&options);
 
-        assert_eq!(csp_content, "default-src 'unsafe-inline' data:;");
+        assert_eq!(
+            csp_content,
+            "default-src 'unsafe-eval' 'unsafe-inline' data:;"
+        );
     }
 
     #[test]
@@ -75,6 +78,6 @@ mod passing {
         options.no_images = true;
         let csp_content = html::compose_csp(&options);
 
-        assert_eq!(csp_content, "default-src 'unsafe-inline' data:; style-src 'none'; font-src 'none'; frame-src 'none'; child-src 'none'; script-src 'none'; img-src data:;");
+        assert_eq!(csp_content, "default-src 'unsafe-eval' 'unsafe-inline' data:; style-src 'none'; font-src 'none'; frame-src 'none'; child-src 'none'; script-src 'none'; img-src data:;");
     }
 }
diff --git a/tests/html/serialize_document.rs b/tests/html/serialize_document.rs
index 3cf648b..bea47e4 100644
--- a/tests/html/serialize_document.rs
+++ b/tests/html/serialize_document.rs
@@ -40,7 +40,7 @@ mod passing {
             )),
             "<html>\
                 <head>\
-                    <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-inline' data:;\"></meta>\
+                    <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-eval' 'unsafe-inline' data:;\"></meta>\
                     <title>Isolated document</title>\
                     <link rel=\"something\" href=\"some.css\">\
                     <meta http-equiv=\"Content-Security-Policy\" content=\"default-src https:\">\
@@ -135,7 +135,7 @@ mod passing {
             "<!DOCTYPE html>\
                 <html>\
                     <head>\
-                        <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-inline' data:; style-src 'none'; font-src 'none'; frame-src 'none'; child-src 'none'; script-src 'none'; img-src data:;\"></meta>\
+                        <meta http-equiv=\"Content-Security-Policy\" content=\"default-src 'unsafe-eval' 'unsafe-inline' data:; style-src 'none'; font-src 'none'; frame-src 'none'; child-src 'none'; script-src 'none'; img-src data:;\"></meta>\
                         <title>no-frame no-css no-js no-image isolated document</title>\
                         <meta http-equiv=\"Content-Security-Policy\" content=\"default-src https:\">\
                         <link rel=\"stylesheet\" href=\"some.css\">\