tauri:// 协议与 CSP

        .on_web_resource_request(|req, resp| {
          let h = |n: &str| resp.headers().get(n).map(|v| v.to_str().unwrap().to_string());
          println!(
            "RUST {} {} -> {} ct={:?} len={} csp={:?}",
            req.method(),
            req.uri(),
            resp.status().as_u16(),
            h("content-type").unwrap_or_default(),
            resp.body().len(),
            h("content-security-policy"),
          );
        })

  Box::new(move |_, request, responder| {
    let context = context.clone();
    crate::async_runtime::spawn(async move {
      match get_response(&context, request).await {
        Ok(response) => responder.respond(response),
        Err(e) => responder.respond(
          HttpResponse::builder()
            .status(StatusCode::INTERNAL_SERVER_ERROR)
            .header(CONTENT_TYPE, mime::TEXT_PLAIN.essence_str())
            .header("Access-Control-Allow-Origin", &context.window_origin)
            .body(e.to_string().into_bytes())
            .unwrap(),
        ),
      }
    });
  })

  // use the entire URI as we are going to proxy the request
  let path = if PROXY_DEV_SERVER {
    request.uri().to_string()
  } else {
    // ignore query string and fragment
    request
      .uri()
      .to_string()
      .split(&['?', '#'])
      .next()
      .unwrap()
      .into()
  };

  let path = path
    .strip_prefix("tauri://localhost")
    .map(|p| p.to_string())
    // the `strip_prefix` only returns None when a request is made to `https://tauri.$P` on Windows and Android
    // where `$P` is not `localhost/*`
    .unwrap_or_default();

  #[allow(unused_mut)]
  let mut builder = HttpResponse::builder()
    .add_configured_headers(manager.config.app.security.headers.as_ref())
    .header("Access-Control-Allow-Origin", window_origin);

  pub fn get_asset(&self, mut path: String, _use_https_schema: bool) -> crate::Result<Asset> {
    let assets = &self.assets;
    if path.ends_with('/') {
      path.pop();
    }
    path = percent_encoding::percent_decode(path.as_bytes())
      .decode_utf8_lossy()
      .to_string();
    let path = if path.is_empty() {
      // if the url is `tauri://localhost`, we should load `index.html`
      "index.html".to_string()
    } else {
      // skip the leading `/`, if it starts with one.
      path.strip_prefix('/').unwrap_or(path.as_str()).to_string()
    };

    let mut asset_path = AssetKey::from(path.as_str());

    let asset_response = assets
      .get(&asset_path)
      .or_else(|| {
        log::debug!("Asset `{path}` not found; fallback to {path}.html");
        let fallback = format!("{path}.html").into();
        let asset = assets.get(&fallback);
        asset_path = fallback;
        asset
      })
      .or_else(|| {
        log::debug!("Asset `{path}` not found; fallback to {path}/index.html",);
        let fallback = format!("{path}/index.html").into();
        let asset = assets.get(&fallback);
        asset_path = fallback;
        asset
      })
      .or_else(|| {
        log::debug!("Asset `{path}` not found; fallback to index.html");
        let fallback = AssetKey::from("index.html");
        let asset = assets.get(&fallback);
        asset_path = fallback;
        asset
      })
      .ok_or_else(|| {
        let error = crate::Error::AssetNotFound(path.clone());
        log::error!("{error}");
        error
      })?;

  "(empty)": "200 text/html len=2322 csp=no | <!doctype html><html><",
  "/": "200 text/html len=2322 csp=no | <!doctype html><html><",
  "/index.html": "200 text/html len=2322 csp=no | <!doctype html><html><",
  "/app.js": "200 text/javascript len=21 csp=no | window.__app = 'ran' ",
  "/style.css": "200 text/css len=30 csp=no | #t { color: rgb(0, 0, ",
  "/data.json": "200 application/json len=13 csp=no | {\"ok\": true} ",
  "/img.png": "200 image/png len=104 csp=no | �PNG \u001a \u0000\u0000\u0000 IHDR\u0000\u0000\u0000 \u0000\u0000",
  "/about": "200 text/html len=52 csp=no | <!doctype html><html><",
  "/sub": "200 text/html len=51 csp=no | <!doctype html><html><",
  "/sub/": "200 text/html len=51 csp=no | <!doctype html><html><",
  "/missing.js": "200 text/html len=2322 csp=no | <!doctype html><html><",
  "/missing.png": "200 text/html len=2322 csp=no | <!doctype html><html><",
  "/a%20b.txt": "200 text/plain len=18 csp=no | file with a space ",
  "/app.js?v=1": "200 text/javascript len=21 csp=no | window.__app = 'ran' ",
  "tauri://other/app.js": "200 text/html len=2322 csp=no | <!doctype html><html><"

    let mut csp_header = None;
    let is_html = asset_path.as_ref().ends_with(".html");

    let final_data = if is_html {
      let mut asset = String::from_utf8_lossy(&asset_response).into_owned();
      if let Some(csp) = self.csp() {
        #[allow(unused_mut)]
        let mut csp_map = set_csp(&mut asset, &self.assets, &asset_path, self, csp);
        // ...
        csp_header.replace(Csp::DirectiveMap(csp_map).to_string());
      }

      asset.into_bytes()
    } else {
      asset_response.into_owned()
    };
    let mime_type = tauri_utils::mime_type::MimeType::parse(&final_data, &path);

fn replace_csp_nonce(
  asset: &mut String,
  token: &str,
  csp: &mut HashMap<String, CspDirectiveSources>,
  directive: &str,
  hashes: Vec<String>,
) {
  let mut nonces = Vec::new();
  *asset = replace_with_callback(asset, token, || {
    let nonce = getrandom::u64().expect("failed to get random bytes");
    nonces.push(nonce);
    nonce.to_string()
  });

  if !(nonces.is_empty() && hashes.is_empty()) {
    let nonce_sources = nonces
      .into_iter()
      .map(|n| format!("'nonce-{n}'"))
      .collect::<Vec<String>>();
    let sources = csp.entry(directive.into()).or_default();
    let self_source = "'self'".to_string();
    if !sources.contains(&self_source) {
      sources.push(self_source);
    }
    sources.extend(nonce_sources);
    sources.extend(hashes);
  }
}

RUST GET tauri://localhost/ -> 200 ct="text/html" len=2378 csp=Some("style-src 'self' 'nonce-17767490473118534858'; default-src 'self'; script-src 'self' 'unsafe-inline' http://127.0.0.1:18940 'nonce-305600598069571656' 'sha256-BTREx9ZDyKjGWdz5HC5IOZvadERqq0X+yyG/Xl9VNPA=' 'sha256-xUIyLn99oaiR/tHtvWU9ovl1YWuCUKgElgzxjd5SJHI='; connect-src 'self' ipc: http://ipc.localhost")

 "index_twice": [
  {
   "body": [
    "8241531850663135075",
    "5380073773138385343",
    "([^"
   ],
   "header": "default-src 'self'; connect-src 'self' ipc: http://ipc.localhost; script-src 'self' 'unsafe-inline' http://127.0.0.1:18940 'nonce-5380073773138385343' 'sha256-BTREx9ZDyKjGWdz5HC5IOZvadERqq0X+yyG/Xl9VNPA=' 'sha256-xUIyLn99oaiR/tHtvWU9ovl1YWuCUKgElgzxjd5SJHI='; style-src 'self' 'nonce-8241531850663135075'",
   ...
  },
  {
   "body": [
    "2477963941207533640",
    "2374367645713661052",
    "([^"
   ],
   "header": "default-src 'self'; style-src 'self' 'nonce-2477963941207533640'; connect-src 'self' ipc: http://ipc.localhost; script-src 'self' 'unsafe-inline' http://127.0.0.1:18940 'nonce-2374367645713661052' 'sha256-BTREx9ZDyKjGWdz5HC5IOZvadERqq0X+yyG/Xl9VNPA=' 'sha256-xUIyLn99oaiR/tHtvWU9ovl1YWuCUKgElgzxjd5SJHI='"
  }
 ]

pub(crate) fn origin(scheme: &str, use_https: bool) -> String {
  if cfg!(windows) || cfg!(target_os = "android") {
    let http = if use_https { "https" } else { "http" };
    format!("{http}://{scheme}.localhost")
  } else {
    format!("{scheme}://localhost")
  }
}

REPORT {
 "inline_onclick": "blocked",
 "app_js": "ran",
 "remote_js": "ran",
 "inline_style": "rgb(255, 0, 0)",
 "linked_style": "rgb(0, 0, 255)",
 "dynamic_remote_js": "loaded",