search

suren-atoyan / monaco-loader

The utility to easy setup monaco-editor into your browser
MIT License
177 stars 37 forks source link

Content-security-policy refuse to load cdn files. #42

Open 1fc0nfig opened 7 months ago

1fc0nfig commented 7 months ago

Hey, i have came across this bug when developing a chrome extension (mV3). I have a devtools page in which i wanted to use monaco - i have tried many configuartions without any success - i believe it is because of how the loader script is added to the body (appending)

Refused to load the script 'https://cdn.jsdelivr.net/npm/monaco-editor@0.21.1/min/vs/asdasdasd/loader.js' because it violates the following Content Security Policy directive: "script-src 'self' 'wasm-unsafe-eval' 'inline-speculation-rules' http://localhost: http://127.0.0.1:". Note that 'script-src-elem' was not explicitly set, so 'script-src' is used as a fallback.

https://github.com/suren-atoyan/monaco-loader/blob/0c12b01c50b8e1e16b1c678388945679f55996f5/src/loader/index.js#L77

Not really sure if that is the case or not (chrome runtimes are weird). Keep it up!

Matyas

1fc0nfig commented 7 months ago

Based on the documentation - it may only require to add some attributes to the import script element: https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Content-Security-Policy/script-src