From 09979c63835500a2f7a99ca3bb5153e861cd6ea2 Mon Sep 17 00:00:00 2001
From: fendly2 <fendly@gmail.com>
Date: Tue, 30 Jun 2026 23:42:15 +0800
Subject: [PATCH] fix: resolve CSP violations by removing inline styles and
 allowing data images

---
 manifest.json |  2 +-
 popup.html    | 12 ++++++------
 style.css     | 26 ++++++++++++++++++++++++++
 3 files changed, 33 insertions(+), 7 deletions(-)

diff --git a/manifest.json b/manifest.json
index 0847546..a525d07 100644
--- a/manifest.json
+++ b/manifest.json
@@ -17,7 +17,7 @@
     "http://127.0.0.1/*"
   ],
   "content_security_policy": {
-    "extension_pages": "default-src 'self'; connect-src https://integrate.api.nvidia.com https: http://localhost:* http://127.0.0.1:*; object-src 'none'"
+    "extension_pages": "default-src 'self'; connect-src https://integrate.api.nvidia.com https: http://localhost:* http://127.0.0.1:*; img-src 'self' data:; object-src 'none'"
   },
   "action": {
     "default_popup": "popup.html",
diff --git a/popup.html b/popup.html
index 84737a3..d96e54e 100644
--- a/popup.html
+++ b/popup.html
@@ -32,11 +32,11 @@ <h2 class="text-title">AI 翻译助手</h2>
           </div>
           <label for="output" class="sr-only">输出结果</label>
           <textarea id="output" class="translation-output" placeholder="结果将显示在这里..." readonly rows="8"></textarea>
-          <div class="control-row" style="margin-top:6px; width:100%">
+          <div class="control-row output-actions">
             <button id="copyThinkBtn" class="action-btn">复制结果</button>
           </div>
       </div>
-      <div class="loading-indicator" style="display: none;">
+      <div class="loading-indicator">
         <span class="loading-text">请稍等，正在处理...</span>
       </div>
     </section>
@@ -91,8 +91,8 @@ <h3 class="text-title">模型设置</h3>
             </div>
           </div>
         </div>
-        <div style="margin-top: 20px;">
-          <button id="saveApiKeyBtn" class="action-btn full-width" style="padding: 12px;">
+        <div class="settings-save-container">
+          <button id="saveApiKeyBtn" class="action-btn full-width">
             保存设置
           </button>
         </div>
@@ -105,8 +105,8 @@ <h3 class="text-title">模型设置</h3>
           <h3 class="text-title">最近 10 条记录</h3>
         </div>
         <div class="history-container">
-          <ul id="historyList" class="history-list" style="margin-top:16px;"></ul>
-          <button id="clearHistoryBtn" class="action-btn full-width" style="margin-top: 14px;">
+          <ul id="historyList" class="history-list"></ul>
+          <button id="clearHistoryBtn" class="action-btn full-width">
             清除历史记录
           </button>
         </div>
diff --git a/style.css b/style.css
index 9408850..cd85f06 100644
--- a/style.css
+++ b/style.css
@@ -649,4 +649,30 @@ body {
   text-align: center;
   font-size: 11px;
   color: var(--text-secondary-color);
+}
+
+/* CSP compliance styles replacing previous inline styles */
+.loading-indicator {
+  display: none; /* hidden by default, shown via JS */
+}
+
+.control-row.output-actions {
+  margin-top: 6px;
+  width: 100%;
+}
+
+.settings-save-container {
+  margin-top: 20px;
+}
+
+#saveApiKeyBtn {
+  padding: 12px;
+}
+
+#historyList {
+  margin-top: 16px;
+}
+
+#clearHistoryBtn {
+  margin-top: 14px;
 }
\ No newline at end of file