fix: quote trusted-types-eval and the other missing CSP keywords

[lprnmns]

#15938 added 'unsafe-allow-redirects', 'unsafe-webtransport-hashes' and 'trusted-types-eval' to the Csp.BaseSource type, but not to the quoted set in csp.js. So they are written into the header without quotes:

script-src 'self' trusted-types-eval

Browsers read an unquoted keyword as a host source named trusted-types-eval, and the keyword itself has no effect. The same goes for 'allow-duplicates' in the trusted-types directive (its type is 'none' | 'allow-duplicates' | '*' | string): unquoted, it is read as a policy name. This PR adds the four keywords to quoted.

While adding a test for this, I found that it never ran. Since the Vitest 5 upgrade (#17084), Vitest sets process.env.DEV itself, so describe.skipIf(!!process.env.DEV) skips the "CSPs in prod" and "cookies in prod" suites in every project. That covers 23 CSP tests, including the one added in #17398, and 33 cookie tests. The kit-server-build project now sets its own KIT_TEST_DEV flag, and the two spec files check that one instead. With this, the prod suites run in kit-server-dev and the dev suites in kit-server-build, and they all pass.

---

Please don't delete this checklist! Before submitting the PR, please make sure you do the following:

• It's really useful if your PR references an issue where it is discussed ahead of time. In many cases, features are absent for a reason. For large changes, please create an RFC: https://github.com/sveltejs/rfcs
• This message body should clearly illustrate what problems it solves.
• Ideally, include a test that fails without this PR but passes with it.

Tests

• Run the tests with pnpm test and lint the project with pnpm lint and pnpm check

The new test fails without the change to csp.js, with the keywords unquoted. pnpm -F @sveltejs/kit test:unit (1120 tests), pnpm lint and pnpm check in packages/kit pass. I didn't run the Playwright suites.

Changesets

• If your PR makes a change that should be noted in one or more packages' changelogs, generate a changeset by running pnpm changeset and following the prompts. Changesets that add features should be minor and those that fix bugs should be patch. Please prefix changeset messages with feat:, fix:, or chore:.

[pkg-svelte-dev]

Install the latest version of @sveltejs/kit from 327b263:

pnpm add https://pkg.svelte.dev/@sveltejs/kit/c/327b2639eaed358b0bcbe353adbacc81f3c54755

Open in pkg.svelte.dev: https://pkg.svelte.dev/repos/kit/pr/17490

Note

This PR is from a fork. A maintainer must approve approve each commit before it can be built and installed.

[changeset-bot]

🦋 Changeset detected

Latest commit: 327b263

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@sveltejs/kit	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR