From d39708b3f66c38384e24509bc7a3d70b6c7b2f6e Mon Sep 17 00:00:00 2001
From: yyh <yuanyouhuilyz@gmail.com>
Date: Fri, 23 Jan 2026 17:38:38 +0800
Subject: [PATCH] fix(csp): add wasm-unsafe-eval to enable WebAssembly
 execution

SQLite preview feature requires WebAssembly to run wa-sqlite, but CSP
policy was blocking WebAssembly.instantiate() without wasm-unsafe-eval
directive in script-src.
---
 web/proxy.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/web/proxy.ts b/web/proxy.ts
index 05436557d7..26b03eacd9 100644
--- a/web/proxy.ts
+++ b/web/proxy.ts
@@ -34,7 +34,7 @@ export function proxy(request: NextRequest) {
   const cspHeader = `
     default-src 'self' ${scheme_source} ${csp} ${whiteList};
     connect-src 'self' ${scheme_source} ${csp} ${whiteList};
-    script-src 'self' ${scheme_source} ${csp} ${whiteList};
+    script-src 'self' 'wasm-unsafe-eval' ${scheme_source} ${csp} ${whiteList};
     style-src 'self' 'unsafe-inline' ${scheme_source} ${whiteList};
     worker-src 'self' ${scheme_source} ${csp} ${whiteList};
     media-src 'self' ${scheme_source} ${csp} ${whiteList};