diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-30 13:09:47 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-30 13:09:54 +0200 |
| commit | 87725dc7a2da27c2ca3b9e58af751f0e6f8c9de7 (patch) | |
| tree | 4bb433e12a959d497d537c5cf3abec993795daee /docs | |
| parent | 2c6921aa2c35ffd41b6c453e6700574ef631ba2c (diff) | |
| download | meshbay-87725dc7a2da27c2ca3b9e58af751f0e6f8c9de7.tar.gz | |
fix: the page connects to its own origin and reCAPTCHA, nowhere else
connect-src drops https: and wss: in both policies. Checked against Google's
reCAPTCHA test keys: in Chrome widget, token and registration unchanged; in
Firefox the widget loads; no violation reported in either.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'docs')
| -rw-r--r-- | docs/MESHBAY_DESIGN.md | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/docs/MESHBAY_DESIGN.md b/docs/MESHBAY_DESIGN.md index d63f722..b44359f 100644 --- a/docs/MESHBAY_DESIGN.md +++ b/docs/MESHBAY_DESIGN.md @@ -3266,7 +3266,7 @@ be understood, not so the incident can be retold. | Label | The rule it names | |---|---| | **H1** | **Per-group isolation on a multi-group node**: the chat store, the peer registry and the broadcast set are per group | -| **H2** | Every value that originates outside the node — filenames chosen by members, usernames originating at the hub — is escaped where it is rendered. A CSP contains exfiltration but cannot prevent injected inline script, so escaping is the actual fix | +| **H2** | Every value that originates outside the node — filenames chosen by members, usernames originating at the hub — is escaped where it is rendered. A CSP contains exfiltration — `connect-src` names the page's own origin and reCAPTCHA's, nothing else — but cannot prevent injected inline script, so escaping is the actual fix. The reCAPTCHA hosts in `script-src` remain a known gadget risk: a nonce policy would remove it, and the application's page, served from disk, cannot carry one | | **H3** | **No public key is ever fetched from a directory to wrap a group key for.** The node wraps for a key the recipient proved possession of, bound to an account by a code the hub never sees (§3.4) | | **H4** | Revocation reaches nodes, drops live sessions, and **persists across a restart** (§7.5) | | **H5** | An admin challenge is a **structured, domain-separated transcript naming the operation and subject**, and the client refuses to sign anything that is not what the user asked for (§5.4) | |