vacp2p/linea-monorepo
1
0
Fork 0
mirror of https://github.com/vacp2p/linea-monorepo.git synced 2026-01-09 04:08:01 -05:00
Code Issues Packages Projects Releases Wiki Activity

add unsafe eval to dev (#1127)

Browse Source
This commit is contained in:
kyzooghost
2025-06-10 19:31:51 +10:00
committed by GitHub
parent 5acbb94e99
commit 4ed4fc0b08
2 changed files with 5 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
bridge-ui/.env.template
View File

@@ -31,7 +31,7 @@ NEXT_PUBLIC_LAYERSWAP_API_KEY=<LAYERSWAP_API_KEY>
NEXT_PUBLIC_IS_CCTP_ENABLED=true
NEXT_PUBLIC_ENVIRONMENT=development
NEXT_PUBLIC_ENVIRONMENT=local
E2E_TEST_PRIVATE_KEY=<YOUR_PRIVATE_KEY>

5
bridge-ui/src/middleware.ts
View File

@@ -4,6 +4,9 @@ import { NextRequest, NextResponse } from "next/server";
export function middleware(request: NextRequest) {
const nonce = Buffer.from(crypto.randomUUID()).toString("base64");
// We only want to allow unsafe-eval in local environment for NextJS dev server
const unsafeEvalScript = process.env.NEXT_PUBLIC_ENVIRONMENT === "local" ? "unsafe-eval" : "";
/**
* Content Security Policy (CSP) configuration:
*
@@ -49,7 +52,7 @@ export function middleware(request: NextRequest) {
*/
const cspHeader = `
default-src 'self';
script-src 'self' 'nonce-${nonce}' 'strict-dynamic';
script-src 'self' 'nonce-${nonce}' ${unsafeEvalScript} https://bridge.linea.build;
style-src 'self' 'unsafe-inline';
img-src 'self' blob: data: https:;
font-src 'self' data: https://cdn.jsdelivr.net;