Allow WebAssembly in Custom Plugins (add 'wasm-unsafe-eval' to the plugin CSP)
S
Sandro Koll
Description:
Custom Plugins currently run under a CSP of script-src 'self' 'unsafe-inline', which blocks WebAssembly.compile() and WebAssembly.instantiate().
This prevents plugins written in languages that compile to WebAssembly, such as Go, Rust or C#, from running in Port, even when the whole plugin is a single self-contained HTML file within the 10 MB limit.
Requested:
- Add 'wasm-unsafe-eval' to the script-src of the Custom Plugins CSP, so WebAssembly modules embedded in the plugin file can compile and run.
- Optionally, make this an opt-in setting per organization or per plugin, so admins can choose to allow it.
Use case:
Teams that already have tooling or UI logic in Go or other WASM-compiled languages want to reuse it in Port plugins instead of rewriting it in JavaScript or TypeScript.
Notes:
'wasm-unsafe-eval' only allows WebAssembly compilation. It does not enable JavaScript eval(), so the rest of the CSP (connect-src limited to Port domains, Trusted Types, object-src and frame-src 'none') would stay the same.