HTML injection and CSP

STATIC’s page-visible changes require execution in the browser. The proxy inserts a reference to its local document runtime and supplies a resolved browser policy on eligible HTML responses. Eligible fetched worker scripts have a separate bootstrap path. Rust performs response handling outside the browser; each initialized realm owns its browser-side state.

Eligibility and insertion

A document response must be successful, have an eligible text/html body, be nonempty and decode as UTF-8. Gzip, deflate, Brotli and Zstandard decoding are subject to configured body limits; unsupported encodings or unsuitable content leave the document unmodified. HTTP/2 may buffer HTML/XHTML candidates before the stage decides whether HTML insertion qualifies.

Duplicate handling uses private per-Flow state. A byte-preserving token scanner selects a document insertion point while skipping recognized comments, quoted attributes, raw-text elements, inert templates and foreign content. It does not implement the complete HTML parsing algorithm; adversarial first-code ordering remains a browser acceptance requirement. Its data-static-config-b64 carrier holds the resolved browser policy; /__static/runtime.js is served by STATIC without an origin fetch. The runtime validates/copies the UTF-8 input and consumes the carrier after reading it. Encoding and cleanup are not secrecy guarantees for declared settings.

An x-static-injected: 1 header marks changed HTML, and response length/encoding metadata is reconciled. That header describes a response transformation, not successful execution or complete API protection.

Content Security Policy

An applicable existing script nonce can be reused. For eligible HTML without one, STATIC can prepare a nonce and adjust applicable header/meta script directives for the inserted runtime. CSP finalization applies the document changes when injection occurred. This is a policy modification, not a transparent guarantee that every site’s security policy and ordering will work.

Worker policy is preserved: the path does not automatically add blob: to worker-src. A module bootstrap is skipped when its required runtime import cannot be admitted conservatively. A forbidden frame fallback is not made permissible by adding unsafe-eval. HTML script permission, worker import permission and runtime execution are separate concerns.

Fetched worker scripts

Eligible dedicated, shared and fresh service-worker responses can receive a worker-specific bootstrap while retaining the original URL, constructor options, import bases, sharing and registration scope. The stage checks worker request metadata, successful JavaScript response prerequisites, encoding, UTF-8, parser limits and applicable CSP. Source parsing and fetch metadata inform classic/module insertion. A module need not contain import/export tokens, and syntax alone cannot authenticate constructor execution mode.

Classic insertion preserves directive ordering. Module insertion provides an early runtime dependency where permitted. These paths deliver only the worker-supported policy; they do not execute the DOM-dependent Window entry unchanged. Transport metadata distinguishes insertion, skipped/unsupported prerequisites and execution-unverified coverage.

Blob/data workers, already running instances, cached scripts and worklet processors do not acquire a general protection guarantee from response rewriting. Reachable frame fallback uses actual private initializer outcomes, not script-path presence. Access/observation/load hooks remain sensitive to early child code, origin restrictions, CSP/Trusted Types and independent bundle ownership. See the runtime coverage matrix.

Caching and other responses

For eligible navigations and bootstrap assets, STATIC strips conditional validators that could produce a bodyless 304. Local runtime/bootstrap handling removes stale validators and uses cache-control appropriate to transformed content; worker body changes also invalidate content validators. This cannot force every browser/service-worker cache path to traverse the proxy.

Alt-Svc handling is separate and can reduce alternative-transport bypasses. Insertion is not retroactive: unproxied content, active service-worker-owned responses, unsuitable scripts and browser-native operations remain boundaries. See injection, CSP and connection handling. Next: what the runtime does.