diff options
| author | Christophe Besson <cbesson@gmail.com> | 2026-09-30 13:09:47 +0200 |
|---|---|---|
| committer | Christophe Besson <cbesson@gmail.com> | 2026-09-30 13:09:54 +0200 |
| commit | 87725dc7a2da27c2ca3b9e58af751f0e6f8c9de7 (patch) | |
| tree | 4bb433e12a959d497d537c5cf3abec993795daee /packages/meshbay-hub/tests | |
| parent | 2c6921aa2c35ffd41b6c453e6700574ef631ba2c (diff) | |
| download | meshbay-87725dc7a2da27c2ca3b9e58af751f0e6f8c9de7.tar.gz | |
fix: the page connects to its own origin and reCAPTCHA, nowhere else
connect-src drops https: and wss: in both policies. Checked against Google's
reCAPTCHA test keys: in Chrome widget, token and registration unchanged; in
Firefox the widget loads; no violation reported in either.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Diffstat (limited to 'packages/meshbay-hub/tests')
| -rw-r--r-- | packages/meshbay-hub/tests/test_desktop_shell.py | 17 |
1 files changed, 10 insertions, 7 deletions
diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py index 732ba07..6e1c634 100644 --- a/packages/meshbay-hub/tests/test_desktop_shell.py +++ b/packages/meshbay-hub/tests/test_desktop_shell.py @@ -226,14 +226,17 @@ def _directive(name: str) -> str: def test_the_hub_is_reachable_but_never_executable(): """ - connect-src allows the hub's API and its signaling socket. script-src does - not: nothing the hub returns is ever executed. The only script sources are - 'self', the wasm eval token, and the two reCAPTCHA hosts (see the next - test) — never a bare `https:` scheme, which would let the hub's own origin - serve script. + The page connects to its own files and to reCAPTCHA, nothing else: every + hub call leaves from the main process (a page on `app://` is refused by + CORS anyway), and the node arrives over WebRTC, which connect-src does not + govern. A bare `https:` there let injected script post anything anywhere. + script-src never names the hub: nothing it returns is ever executed. The + only script sources are 'self', the wasm eval token, and the two reCAPTCHA + hosts (see the next test) — never a bare `https:` scheme, which would let + the hub's own origin serve script. """ - connect = _directive("connect-src") - assert "https:" in connect and "wss:" in connect + connect = _directive("connect-src").split()[1:] + assert set(connect) == {"'self'", "https://www.google.com", "https://www.gstatic.com"} script = _directive("script-src") assert script, "no script-src directive" |