scriptoriumadmin/Roo-Code
1
0
Fork 0
mirror of https://github.com/RooVetGit/Roo-Code.git synced 2026-08-28 05:27:24 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fix: add file+.vscode-resource.vscode-cdn.net to CSP for portable VS Code support

Browse source 
- Added file+.vscode-resource.vscode-cdn.net protocol to connect-src and media-src directives
- This fixes audio playback and API requests in portable VS Code environments
- Updated tests to verify the CSP includes the necessary protocols

Fixes #5949
This commit is contained in:
Roo Code 2025-07-19 15:26:42 +00:00
parent cc369da2d5
commit 537cd8069d
2 changed files with 8 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

6
src/core/webview/ClineProvider.ts
View file

@ -679,9 +679,9 @@ export class ClineProvider
`font-src ${webview.cspSource} data:`,
`style-src ${webview.cspSource} 'unsafe-inline' https://* http://${localServerUrl} http://0.0.0.0:${localPort}`,
`img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com data:`,
`media-src ${webview.cspSource}`,
`media-src ${webview.cspSource} file+.vscode-resource.vscode-cdn.net:`,
`script-src 'unsafe-eval' ${webview.cspSource} https://* https://*.posthog.com http://${localServerUrl} http://0.0.0.0:${localPort} 'nonce-${nonce}'`,
`connect-src https://* https://*.posthog.com ws://${localServerUrl} ws://0.0.0.0:${localPort} http://${localServerUrl} http://0.0.0.0:${localPort}`,
`connect-src https://* https://*.posthog.com ws://${localServerUrl} ws://0.0.0.0:${localPort} http://${localServerUrl} http://0.0.0.0:${localPort} file+.vscode-resource.vscode-cdn.net:`,
]
return /*html*/ `
@ -763,7 +763,7 @@ export class ClineProvider
<meta charset="utf-8">
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
<meta name="theme-color" content="#000000">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com data:; media-src ${webview.cspSource}; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' https://us-assets.i.posthog.com 'strict-dynamic'; connect-src https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com;">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; font-src ${webview.cspSource} data:; style-src ${webview.cspSource} 'unsafe-inline'; img-src ${webview.cspSource} https://storage.googleapis.com https://img.clerk.com data:; media-src ${webview.cspSource} file+.vscode-resource.vscode-cdn.net:; script-src ${webview.cspSource} 'wasm-unsafe-eval' 'nonce-${nonce}' https://us-assets.i.posthog.com 'strict-dynamic'; connect-src https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com file+.vscode-resource.vscode-cdn.net:;">
<link rel="stylesheet" type="text/css" href="${stylesUri}">
<link href="${codiconsUri}" rel="stylesheet" />
<script nonce="${nonce}">

7
src/core/webview/__tests__/ClineProvider.spec.ts
View file

@ -471,10 +471,13 @@ describe("ClineProvider", () => {
expect(mockWebviewView.webview.html).toContain("<!DOCTYPE html>")
// Verify Content Security Policy contains the necessary PostHog domains
// Verify Content Security Policy contains the necessary PostHog domains and file protocol
expect(mockWebviewView.webview.html).toContain(
"connect-src https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com",
"connect-src https://openrouter.ai https://api.requesty.ai https://us.i.posthog.com https://us-assets.i.posthog.com file+.vscode-resource.vscode-cdn.net:",
)
// Verify media-src includes file protocol for audio files
expect(mockWebviewView.webview.html).toContain("media-src")
expect(mockWebviewView.webview.html).toContain("file+.vscode-resource.vscode-cdn.net:")
// Extract the script-src directive section and verify required security elements
const html = mockWebviewView.webview.html