fix: resolve webview resource loading errors (ERR_ACCESS_DENIED and 404) #6685
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Remove 'strict-dynamic' from CSP to allow dynamically loaded chunks - Update sourcemap plugin to create compatibility files (index.map.json and index.sourcemap) - Fix source map references in build output to use correct file extensions Fixes #6684
dosubot
bot
added
size:M
![roomote[bot]](https://avatars.githubusercontent.com/in/1546624?s=60&v=4){kind=small}
| <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"> | ||
| <meta name="theme-color" content="#000000"> | ||
| <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' https://us-assets.i.posthog.com 'strict-dynamic'; connect-src ${webview.cspSource} https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com;"> | ||
| <meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' https://us-assets.i.posthog.com; connect-src ${webview.cspSource} https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com;"> |
Contributor
Author
There was a problem hiding this comment.
Is removing 'strict-dynamic' from the CSP the only way to fix this? While it solves the immediate issue, it does weaken security slightly. Have you explored alternatives like adding nonces to dynamically imported scripts to maintain the stricter CSP?
| const sourceMappingURLRegex = /\/\/# sourceMappingURL=.*/ | ||
| if (sourceMappingURLRegex.test(jsContent)) { | ||
| // Update existing reference to use correct format | ||
| jsContent = jsContent.replace(sourceMappingURLRegex, `//# sourceMappingURL=${jsFile}.map`) |
Contributor
Author
There was a problem hiding this comment.
The regex replacement here could fail silently. Consider adding validation to ensure the replacement was successful:
//# sourceMappingURL=.mapFailed to update source map reference in
| if (fs.existsSync(indexJsPath) && fs.existsSync(indexMapPath)) { | ||
| // Copy index.js.map to index.map.json for compatibility | ||
| const indexMapJsonPath = path.join(assetsDir, "index.map.json") | ||
| fs.copyFileSync(indexMapPath, indexMapJsonPath) |
Contributor
Author
There was a problem hiding this comment.
Could we reduce duplication here by extracting the compatibility file creation into a helper function? Something like:
Created for compatibility
hannesrudolph
added
the
Issue/PR - Triage
Member
|
The issue needs to be reproduced, closing for now |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR fixes the webview resource loading errors reported in issue #6684 where JavaScript chunks and source maps were failing to load with ERR_ACCESS_DENIED and 404 errors.
Changes:
Testing:
Fixes #6684
Important
Fixes webview resource loading errors by updating CSP and ensuring correct source map references in
ClineProvider.tsandsourcemapPlugin.ts.'strict-dynamic'fromscript-srcin CSP inClineProvider.tsto fix ERR_ACCESS_DENIED for dynamic imports.sourcemapPlugin.tsto ensure all JS files have correctsourceMappingURLreferences and createindex.map.jsonandindex.sourcemapfor compatibility.This description was created by
for 5a44518. You can customize this summary. It will automatically update as commits are pushed.