diff --git a/package.json b/package.json index 1470fa72..141d4475 100644 --- a/package.json +++ b/package.json @@ -23,7 +23,7 @@ "url": "git+https://github.com/opencor/webapp.git" }, "type": "module", - "version": "1.20261016.2", + "version": "1.20261016.3", "engines": { "bun": ">=1.2.0" }, diff --git a/src/renderer/README.md b/src/renderer/README.md index a0e66889..21294ef4 100644 --- a/src/renderer/README.md +++ b/src/renderer/README.md @@ -92,12 +92,12 @@ The `@opencor/opencor` package does **not** ship `libopencor.js`. At runtime, Op libopencor/downloads/wasm//libopencor.js ``` -where `` is the value of the `libopencorVersion` field in the package's `package.json` file. If your application doesn't serve it, then OpenCOR fetches it from `https://opencor.ws/libopencor/downloads/wasm//libopencor.js` and imports it from a [blob URL](https://developer.mozilla.org/en-US/docs/Web/API/URL/createObjectURL_static), so that its worker is same-origin. If your application uses a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP), then this requires: +where `` is the value of the `libopencorVersion` field in the package's `package.json` file. If your application doesn't serve it, then OpenCOR fetches it from `https://opencor.ws/libopencor/downloads/wasm//libopencor.js` and imports it from a [blob URL](https://developer.mozilla.org/en-US/docs/Web/API/URL/createObjectURL_static), so that its pthread workers are same-origin. If your application uses a [Content Security Policy](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP), then this requires: - `connect-src` to allow `https://opencor.ws` (which is needed for the threaded WASM file anyway); and - `script-src` and `worker-src` to allow `blob:`. -If you would rather not allow `blob:` (or would rather not fetch `libopencor.js` from `https://opencor.ws`), then you can self-host `libopencor.js` by downloading it from `https://opencor.ws/libopencor/downloads/wasm//libopencor.js` and serving it, as a JavaScript file, from the above URL. Make sure to do this again whenever you update the `@opencor/opencor` package, since `` will then change. +If you would rather not fetch `libopencor.js` from `https://opencor.ws`, then you can self-host it by downloading it from `https://opencor.ws/libopencor/downloads/wasm//libopencor.js` and serving it, as a JavaScript file, from the above URL. Note that `worker-src` must still allow `blob:` since, on the Web, `libopencor.js` always spawns its pthread workers from blob URLs. Make sure to do this again whenever you update the `@opencor/opencor` package, since `` will then change. ## Usage diff --git a/src/renderer/index.html b/src/renderer/index.html index 2148083a..26ef446b 100644 --- a/src/renderer/index.html +++ b/src/renderer/index.html @@ -7,7 +7,7 @@ + content="default-src 'self'; connect-src *; script-src 'unsafe-eval'; script-src-elem 'self' https://apis.google.com https://cdn.jsdelivr.net https://fastly.jsdelivr.net https://gcore.jsdelivr.net https://cors-proxy.opencor.workers.dev; worker-src 'self' blob:; font-src 'self' data:; style-src 'self' 'unsafe-inline'; frame-src 'self' https://opencorapp.firebaseapp.com; img-src 'self' blob: data:" />