tmk241/hemx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(js): keep standard sse same-origin

Browse Source 
Require non-empty data-slhx-sse values at build time and have the standard runtime reject cross-origin EventSource URLs with slhx:sse-error instead of opening an implicit external stream.

req: push/006

req: diagnostics/002
This commit is contained in:
slhx agent
2026-06-01 21:07:14 +02:00
parent 0315044f53
commit 56f4db88c4
4 changed files with 28 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
slhx-js/runtime/slhx.js
+6 -1
View File
@@ -637,7 +637,12 @@
function bindSse(root) {
const url = root.getAttribute("data-slhx-sse");
if (!url || sseSources.has(root) || typeof EventSource === "undefined") return;
const source = new EventSource(new URL(url, location.href).href);
const href = new URL(url, location.href);
if (href.origin !== location.origin) {
emit(root, "slhx:sse-error", url);
return;
}
const source = new EventSource(href.href);
source.addEventListener("slhx", (event) => applySseMessage(root, event));
source.addEventListener("message", (event) => applySseMessage(root, event));
source.addEventListener("error", () => emit(root, "slhx:sse-error", url));