From 880e3905dce4999968177312067b774593d4da2d Mon Sep 17 00:00:00 2001
From: canglan <admin@sea-studio.top>
Date: Wed, 15 Jul 2026 04:39:23 +0800
Subject: [PATCH] fix: CSP scriptSrcAttr explicitly allow unsafe-inline

---
 backend/server.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/backend/server.js b/backend/server.js
index d2cdbc9..1dc6d1d 100644
--- a/backend/server.js
+++ b/backend/server.js
@@ -42,7 +42,7 @@ app.use(helmet({
       imgSrc: ["'self'", "data:", "blob:"],
       mediaSrc: ["'self'"],
       connectSrc: ["'self'"],
-      scriptSrcAttr: null,
+      scriptSrcAttr: ["'unsafe-inline'"],
     },
   },
   crossOriginEmbedderPolicy: false,