Add Content Security Policy (#24)

Author: getCryptoAddress

package-lock.json

@@ -60,6 +60,7 @@
     "typescript": "~5.6.3",
     "vfonts": "^0.0.3",
     "vite": "^5.4.10",
+    "vite-plugin-csp-guard": "^1.1.3",
     "vitest": "^2.1.4",
     "vue-tsc": "^2.1.10"
   },

package.json

@@ -1,10 +1,23 @@
 import { fileURLToPath, URL } from "node:url";
 import vue from "@vitejs/plugin-vue";
 import { defineConfig } from "vite";
+import csp from "vite-plugin-csp-guard";
 
 // https://vitejs.dev/config/
 export default defineConfig({
-  plugins: [vue()],
+  plugins: [
+    vue(),
+    csp({
+      dev: {
+        run: true,
+        outlierSupport: ["vue"],
+      },
+      policy: {
+        "style-src-elem": ["'unsafe-inline'"],
+        "img-src": ["data:"],
+      },
+    }),
+  ],
   build: {
     target: "es2022",
   },

vite.config.ts renamed to vite.config.mts

@@ -1,6 +1,6 @@
 import { fileURLToPath } from "node:url";
 import { configDefaults, defineConfig, mergeConfig } from "vitest/config";
-import viteConfig from "./vite.config";
+import viteConfig from "./vite.config.mjs";
 
 export default mergeConfig(
   viteConfig,