From 2b00f35b51a8c654fa2198b0f6d146784a7d844e Mon Sep 17 00:00:00 2001
From: Andi <aw@yeapea.com>
Date: Sun, 18 Oct 2026 16:57:59 +0200
Subject: [PATCH] fix(csp): skip fence when enumerating globalThis properties

Chrome 158 raises a FencedFrame deprecation issue when window.fence is
read, and the parser reads every own property of globalThis to collect
its known globals. Skip it the way styleMedia and sharedStorage are
skipped, and test that the parser reads none of the three.
---
 packages/csp/src/parser.js       |  2 +-
 tests/vitest/csp-globals.spec.js | 20 ++++++++++++++++++++
 2 files changed, 21 insertions(+), 1 deletion(-)
 create mode 100644 tests/vitest/csp-globals.spec.js

diff --git a/packages/csp/src/parser.js b/packages/csp/src/parser.js
index 99ef7bd99..133c90f19 100644
--- a/packages/csp/src/parser.js
+++ b/packages/csp/src/parser.js
@@ -3,7 +3,7 @@ let globals = new Set()
 
 Object.getOwnPropertyNames(globalThis).forEach(key => {
     // Prevent Chrome and Safari deprecation warning...
-    if (key === "styleMedia" || key === "sharedStorage") return
+    if (key === "styleMedia" || key === "sharedStorage" || key === "fence") return
 
     let value
 
diff --git a/tests/vitest/csp-globals.spec.js b/tests/vitest/csp-globals.spec.js
new file mode 100644
index 000000000..8da21e0af
--- /dev/null
+++ b/tests/vitest/csp-globals.spec.js
@@ -0,0 +1,20 @@
+// @vitest-environment jsdom
+
+import { it, expect } from 'vitest';
+
+it('does not read the globals that browsers report as deprecated', async () => {
+    let read = []
+
+    for (let key of ['styleMedia', 'sharedStorage', 'fence']) {
+        Object.defineProperty(globalThis, key, {
+            configurable: true,
+            get() {
+                read.push(key)
+            },
+        })
+    }
+
+    await import('../../packages/csp/src/parser.js')
+
+    expect(read).toEqual([])
+})