SyntaxError: Invalid or unexpected token

[kaikai76578]

Please confirm the following

• I have read and agree to AGPL-3.0 Section 15 .
  The program is provided "as is" without any warranties; you bear all risks of using it.

• I have read and agree to AGPL-3.0 Section 16 .
  The copyright holders and distributors are not liable for any damages resulting from the use or inability to use the program.

• I confirm my description is clear, polite, helps developers quickly locate the issue, and complies with community rules.

• I have read the OpenList documentation.

• I confirm there are no duplicate issues or discussions.

• I confirm this is an OpenList issue, not caused by other reasons (such as network, dependencies, or operation).

• I believe this issue must be handled by OpenList and not by a third party.

• I confirm this issue is not fixed in the latest version.

• I have not read these checkboxes and therefore I just ticked them all, Please close this issue.

OpenList Version (required)

v4.2.1

Storage Driver Used (required)

本地存储

Bug Description (required)

在v4.1.10之后的版本，使用webview比较老的浏览器访问webui会出现SyntaxError: Invalid or unexpected token

Logs (required)

无

Configuration File Content (required)

默认

Reproduction Link (optional)

No response

[xrgzs]

使用webview比较老的浏览器访问

由于升级了vite，对比较老的浏览器存在不兼容的情况。请提供一下具体的内核版本。

[kaikai76578]

 Mozilla/5.0 (Linux; Android 8.1.0; XDH-21-A1 Build/O11019; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/85.0.4183.99 Mobile Safari/537.36 

[xrgzs]

Mozilla/5.0 (Linux; Android 8.1.0; XDH-21-A1 Build/O11019; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/85.0.4183.99 Mobile Safari/537.36

之前调试过，pc上最低86才能用

[es-v]

---

复现现象 / Console 日志

在 OpenList v4.2.1（Commit: 8d39d63, build time: 2026-04-09 14:27:23 +0000）下，WebUI 打开后控制台出现并导致页面异常：

• Loading the script 'data:text/javascript,if(!import.meta.resolve)throw Error("import.meta.resolve not supported")' violates the following Content Security Policy directive: "script-src 'self' 'unsafe-inline' 'unsafe-eval' https:" ... The action has been blocked.
• 之后进入 vite: loading legacy chunks ...
• 并在 *-legacy-*.js（如 lightgallery-bundle-legacy-*.js）报：Uncaught SyntaxError: Invalid or unexpected token

环境：Docker 部署 + Nginx 反向代理；浏览器为最新 Edge/Chrome 也会触发。

---

分析

问题不是浏览器语法不兼容，而是 反向代理/网关配置了 CSP，未允许 data: 脚本执行，导致前端（Vite legacy loader 相关逻辑）注入的 data:text/javascript,... 探测/加载脚本被 CSP 拦截，进而 legacy chunk 加载链路异常，最终触发 SyntaxError: Invalid or unexpected token。

关键点：当 CSP 为类似如下时会触发（script-src 不含 data:）：

add_header Content-Security-Policy "...; script-src 'self' 'unsafe-inline' 'unsafe-eval' https:; ...";

---

解决方案

在 Nginx 的 CSP 里给 script-src 增加 data: 允许项，修改后 nginx -t && nginx -s reload，浏览器强刷（Ctrl+F5）即可。