Skip to content

dsh-overleaf v0.2.4

Choose a tag to compare

View all tags
@gychen-NJU gychen-NJU released this 28 Aug 11:53
· 18 commits to main since this release
v0.2.4
6c6ca3c

dsh-overleaf v0.2.4

Fix: the injected <base> was blocked by CSP base-uri 'none'

User console evidence: the editor page's Content-Security-Policy carries base-uri 'none', which blocked v0.2.3's injected <base href="/overleaf-proxy/"> — so relative requests kept resolving against the deep document directory (the /overleaf-logo.svg loop-404 persisted, and the SSE realtime channel stayed broken).

Fix

The CSP rewriter now relaxes base-uri 'none' to base-uri 'self' — the injected base is same-origin, so the directive's guard intent is preserved while allowing exactly the one base the proxy needs. All other directives pass through unchanged.

Offline smoke gained a regression matching the editor-page CSP shape (script-src 'nonce-x' 'strict-dynamic'; base-uri 'none'; object-src 'none').

Upgrade

dsh plugin --profile web add github:gychen-NJU/dsh-overleaf

(already installed? remove first, re-add, restart the web service, then hard-refresh the DSH page with Ctrl+F5)

Assets 3
Loading