CSP violation on every page in Firefox: prefetch of `CustomPickerElement` chunk blocked by `default-src 'none'`

[alex-di-96]

Version: Bookmarks 17.0.0, Nextcloud 35.0.1, Firefox

What happens

On every Nextcloud page (the references entry is loaded globally for the smart picker) Firefox logs:

Content-Security-Policy: The page's settings blocked the loading of a resource (default-src) at
…/apps/bookmarks/js/bookmarks-src_components_CustomPickerElement_vue.js because it violates the following directive: "default-src 'none'"

Why

bookmarks-references.js contains webpack's prefetch runtime (__webpack_require__.F.j → <link rel="prefetch" as="script">)
for the CustomPickerElement chunk, i.e. the dynamic import uses webpackPrefetch: true.
Firefox checks rel=prefetch against default-src (there is no prefetch-src anymore), and Nextcloud's CSP sets
default-src 'none', so the prefetch is always blocked. The chunk is still loaded on demand, so the prefetch
never helps and only produces noise.

Suggested fix

Drop webpackPrefetch: true (magic comment) from the CustomPickerElement dynamic import in the references entry.
We verified locally that disabling the prefetch runtime removes the error and the picker still works.

[github-actions]

Hello 👋

Thank you for taking the time to open this issue with the bookmarks app. I know it's frustrating when software
causes problems. You have made the right choice to come here and open an issue to make sure your problem gets looked at
and if possible solved.
I'm Marcel and have been maintaining this software the last few years. I currently work for Nextcloud but maintain this app
in my free time, because it is not an official Nextcloud product. My day job at Nextcloud is pretty awesome but sadly leaves me with
less time for side projects like this one than I used to have.
I still try to answer all issues and if possible fix all bugs here, but it sometimes takes a while until I get to it.
Until then, please be patient.
Note also that GitHub is a place where people meet to make software better together. Nobody here is under any obligation
to help you, solve your problems or deliver on any expectations or demands you may have, but if enough people come together we can
collaborate to make this software better. For everyone.
Thus, if you can, you could also look at other issues to see whether you can help other people with your knowledge
and experience. If you have coding experience it would also be awesome if you could step up to dive into the code and
try to fix the odd bug yourself. Everyone will be thankful for extra helping hands!
One last word: If you feel, at any point, like you need to vent, this is not the place for it; you can go to the forum,
to twitter or somewhere else. But this is a technical issue tracker, so please make sure to
focus on the tech and keep your opinions to yourself. (Also see our Code of Conduct. Really.)

I look forward to working with you on this issue
Cheers 💙