diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:49:28 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-01 17:49:28 +0200 |
| commit | 30c032f2659fe697f7731dc9ae2cf8b8499177d4 (patch) | |
| tree | abf4354d556d15ea734d0f455f16cc742b88b0c6 /packages/meshbay-client/src | |
| parent | 6b38704d459dec1271c7ca883de3eb14190218f7 (diff) | |
| download | meshbay-30c032f2659fe697f7731dc9ae2cf8b8499177d4.tar.gz | |
fix(client): allow reCAPTCHA in the Electron CSP
Needed for the paired meshbay-hub commit that makes the registration
captcha unconditional (M1): the desktop client renders the same
RegisterPage widget the browser does, which needs its script, its
challenge iframe and its assets to load.
script-src, the new frame-src, and img-src now allow exactly
https://www.google.com and https://www.gstatic.com, and nothing else
external — the hub's own origin is still absent from script-src, so
T3 (nothing the hub returns is executed) is unaffected. This is a
one-time source change: it ships identical in every build via
`files: ["src/**"]` in electron-builder's config, with no build step,
packaging step, or installer action for anyone to perform, and no
setting for an end user to touch.
test_desktop_shell.py updated to pin the exception precisely: the
reCAPTCHA hosts are the *only* external origins allowed anywhere in
the policy, and a bare `https:` scheme is still refused in script-src.
Third security review, finding M1 (Option A, desktop half).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG
Diffstat (limited to 'packages/meshbay-client/src')
| -rw-r--r-- | packages/meshbay-client/src/main.js | 18 |
1 files changed, 16 insertions, 2 deletions
diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js index 3926c01..e3735e6 100644 --- a/packages/meshbay-client/src/main.js +++ b/packages/meshbay-client/src/main.js @@ -58,15 +58,29 @@ const SCHEME = 'app'; // The hub is reachable under connect-src, for its API and its signaling socket. // It is deliberately absent from script-src: nothing it returns is executed, // which is the whole reason this application exists (T3). +// +// The one exception is reCAPTCHA, used to gate sign-up (and password reset) the +// same way it gates them in the browser. Its script comes from www.google.com, +// its challenge is a www.google.com iframe, and its assets sit on +// www.gstatic.com. These two hosts — and only these two — are allowed under +// `script-src`, `frame-src` and `img-src` for that purpose. It is a real, if +// small, dent in "no third-party code runs here": Google's reCAPTCHA script +// executes in the renderer. It is accepted deliberately so a native sign-up is +// gated like a web one without asking the user to do anything extra, and it is +// the *same* dependency the hub-served SPA already carries. If sign-up ever +// moves to a proof-of-work challenge, delete RECAPTCHA_SRC and the three +// directives that spread it, and the widget in auth-page.js with them. +const RECAPTCHA_SRC = 'https://www.google.com https://www.gstatic.com'; const CSP = [ "default-src 'none'", - "script-src 'self' 'wasm-unsafe-eval'", + `script-src 'self' 'wasm-unsafe-eval' ${RECAPTCHA_SRC}`, "style-src 'self' 'unsafe-inline'", - "img-src 'self' data: blob:", + `img-src 'self' data: blob: ${RECAPTCHA_SRC}`, "media-src 'self' blob:", "font-src 'self'", "connect-src 'self' https: wss:", "worker-src 'self'", + `frame-src ${RECAPTCHA_SRC}`, "frame-ancestors 'none'", "base-uri 'none'", "form-action 'none'", |