vitepress

Commit Graph

Author	SHA1	Message	Date
Divyansh Singh	d3b2957db0	fix: serialize config functions as code, not strings revived via new Function (close #3685 ) Functions in the site config (e.g. a custom miniSearch tokenize) were embedded in the client's JSON payload as source strings and rebuilt at runtime with new Function, which strict CSP blocks unless unsafe-eval is allowed. Emit them as plain function expressions in the generated script instead, with only an index marker left in the JSON, so the deserializer just looks them up. This also stops data strings that merely start with "_vp-fn_" from being evaluated as code. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2 weeks ago

Author

SHA1

Message

Date

Divyansh Singh

d3b2957db0

fix: serialize config functions as code, not strings revived via new Function (close #3685 )

Functions in the site config (e.g. a custom miniSearch tokenize) were
embedded in the client's JSON payload as source strings and rebuilt at
runtime with new Function, which strict CSP blocks unless unsafe-eval
is allowed. Emit them as plain function expressions in the generated
script instead, with only an index marker left in the JSON, so the
deserializer just looks them up.

This also stops data strings that merely start with "_vp-fn_" from
being evaluated as code.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

1 Commits (feat/md-sourcemaps)