Repository navigation
feat: add Content-Security-Policy to the desktop webview (#171) - #177
Merged
Merged
Conversation
The desktop webview ran with csp:null while withGlobalTauri exposed the Tauri API, so any markup injection could reach Tauri commands. Add a strict CSP as defense-in-depth: - FastAPI sends a CSP response header (the main app — where the library/ folder UI and the window.__TAURI__ surface live — is served by FastAPI at 127.0.0.1, so the header is the effective policy there). script-src 'self' with no unsafe-inline/eval. - Move the inline <script> + 3 inline onclick handlers out of index.html into a new static/js/ui-chrome.js module so the strict policy doesn't break them. - Set a matching CSP for the bundled Tauri setup shell in tauri.conf.json. Styles keep 'unsafe-inline' (the UI sets many style attributes); connect-src allows same-origin API/SSE, the GitHub update check, and Tauri ipc:; img-src allows https: for remote thumbnails. withGlobalTauri kept (disabling it is a larger refactor for marginal gain once the XSS in #170 is fixed + CSP is on).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #171.
The desktop webview ran with
csp: nullwhilewithGlobalTauri: trueexposed the Tauri API — so any markup injection could reach Tauri commands. Adds a strict CSP as defense-in-depth (the actual XSS hole, #170, is already fixed).Changes
app/main.py) — the main app (where the library/folder UI and thewindow.__TAURI__surface live) is served by FastAPI at127.0.0.1, so a response header is the effective policy there, not justtauri.conf.json.script-src 'self', nounsafe-inline/eval.<script>+ 3 inlineonclickhandlers out ofindex.htmlinto a newstatic/js/ui-chrome.jsmodule so the strict policy doesn't break them.tauri.conf.json) — matching policy for the bundleddesktop/uishell (verified it has no inline scripts).Policy notes
style-srckeeps'unsafe-inline'(the UI sets many inline style attributes — low risk).connect-src 'self' https://api.github.com ipc: http://ipc.localhost— same-origin API/SSE, the update check, and Tauri IPC.img-src … https:— remote YouTube/SoundCloud thumbnails.withGlobalTaurikept — disabling it is a bigger refactor for marginal gain once Stored XSS through library folder names #170 + CSP are in.Verification
<script>/onclickleft; CSP header confirmed on/.eval/new Function/Worker/wasm; the oneURL.createObjectURL(vendor audio) is covered bymedia-src blob:.node --checkall JS, ruff clean.