mirror of
https://github.com/MoonshotAI/kimi-code.git
synced 2026-08-01 04:26:01 +00:00
56ba8e0196
* fix(server): allow inline styles in CSP so web math renders on non-loopback binds The security CSP fell back to default-src 'self' for styles, which strips the inline style attributes that KaTeX (injected via innerHTML) uses for all glyph positioning — formulas collapsed into overlapping characters on any non-loopback-served web UI. Shiki highlighting and Mermaid diagrams hit the same mechanism. Add style-src 'self' 'unsafe-inline'; scripts remain strictly restricted. * test(server): assert the effective script-src in the CSP regression test A negative substring check only rejects one exact string: default-src gaining 'unsafe-inline' (inline <script> allowed via fallback) or an explicit script-src 'unsafe-inline' would both slip through. Parse the directives and assert the effective script policy (script-src, falling back to default-src) excludes 'unsafe-inline'/'unsafe-eval'/data:. |
||
|---|---|---|
| .. | ||
| src | ||
| test | ||
| CHANGELOG.md | ||
| package.json | ||
| tsconfig.dev.json | ||
| tsconfig.json | ||
| tsdown.config.ts | ||
| vitest.config.ts | ||