fix(csp): allow Plain widget and disable Zod JIT in Connect UI#6696
Merged
macko911 merged 3 commits intoJul 7, 2026
Merged
Conversation
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
1 issue found across 2 files
Confidence score: 3/5
- In
packages/connect-ui/src/main.tsx,z.config({ jitless: true })is initialized after static imports, so schemas created viaApp -> routes -> Gocan still trigger CSPunsafe-evalbefore jitless is active; in strict CSP environments this can cause runtime failures or blocked script execution. Move jitless initialization to run before any Zod-using imports (or defer those imports until after config) and verify with a CSP-enabled startup test before merging.
Prompt for AI agents (unresolved issues)
Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.
<file name="packages/connect-ui/src/main.tsx">
<violation number="1" location="packages/connect-ui/src/main.tsx:11">
P2: CSP `unsafe-eval` can still occur because `z.config({ jitless: true })` runs after static imports are evaluated, while Zod schemas are created in modules loaded through `App -> routes -> Go`. Initializing jitless in a side-effect module imported before `App` (or another guaranteed earliest entrypoint) would make this reliably effective.</violation>
</file>
Reply with feedback, questions, or to request a fix.
Re-trigger cubic
Add *.cdn-plain.com (script/font) and *.plain.com + wss://*.plain.com (connect) to the helmet CSP so the Plain support widget isn't blocked. Mirrors the CloudFront policy for the front-end distributions.
Zod v4's JIT validator compiles with `new Function`, tripping the
Connect UI's `script-src` (report-only today). `z.config({ jitless:
true })` uses the identical non-JIT path, so `script-src 'self'` needs
no `'unsafe-eval'`.
ES modules evaluate all imports before the importing module's body, so the inline `z.config()` ran after App's schema modules were already loaded. Move it to a side-effect module imported first, so jitless is set before any Zod schema in the App tree is created.
macko911
force-pushed
the
matej/nan-6012-nan-006-oneleet-pentest-finding-lack-of-content-security
branch
from
July 7, 2026 08:17
b939fa1 to
f5197f6
Compare
macko911
marked this pull request as ready for review
July 7, 2026 08:33
pfreixes
approved these changes
Jul 7, 2026
macko911
deleted the
matej/nan-6012-nan-006-oneleet-pentest-finding-lack-of-content-security
branch
July 7, 2026 11:15
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The report-only CSP rollout on the front-end distributions (NAN-6012; infra in nango-infra#165) surfaced two violations on dev that would break under enforcement:
script-srcvianew Function.Solution
*.cdn-plain.comfor script/font,*.plain.com+wss://*.plain.comfor connect) to the helmet CSP, mirroring the CloudFront policy so self-hosted/API stay in sync.z.config({ jitless: true })disables Zod v4's JIT validator (which compiles withnew Function). The non-JIT path is functionally identical, so the Connect UI keepsscript-src 'self'with no'unsafe-eval'.Fixes NAN-6012
Testing
report-uriPOSTs) is clean.evalreport clears once this deploys (Zod also falls back gracefully under enforcement regardless).