From 30c032f2659fe697f7731dc9ae2cf8b8499177d4 Mon Sep 17 00:00:00 2001 From: Christophe Besson Date: Tue, 1 Sep 2026 17:49:28 +0200 Subject: fix(client): allow reCAPTCHA in the Electron CSP MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Needed for the paired meshbay-hub commit that makes the registration captcha unconditional (M1): the desktop client renders the same RegisterPage widget the browser does, which needs its script, its challenge iframe and its assets to load. script-src, the new frame-src, and img-src now allow exactly https://www.google.com and https://www.gstatic.com, and nothing else external — the hub's own origin is still absent from script-src, so T3 (nothing the hub returns is executed) is unaffected. This is a one-time source change: it ships identical in every build via `files: ["src/**"]` in electron-builder's config, with no build step, packaging step, or installer action for anyone to perform, and no setting for an end user to touch. test_desktop_shell.py updated to pin the exception precisely: the reCAPTCHA hosts are the *only* external origins allowed anywhere in the policy, and a bare `https:` scheme is still refused in script-src. Third security review, finding M1 (Option A, desktop half). Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_011pG75yGK3NthNfyjH74omG --- packages/meshbay-client/src/main.js | 18 ++++++++-- packages/meshbay-hub/tests/test_desktop_shell.py | 42 +++++++++++++++++++++--- 2 files changed, 54 insertions(+), 6 deletions(-) (limited to 'packages') diff --git a/packages/meshbay-client/src/main.js b/packages/meshbay-client/src/main.js index 3926c01..e3735e6 100644 --- a/packages/meshbay-client/src/main.js +++ b/packages/meshbay-client/src/main.js @@ -58,15 +58,29 @@ const SCHEME = 'app'; // The hub is reachable under connect-src, for its API and its signaling socket. // It is deliberately absent from script-src: nothing it returns is executed, // which is the whole reason this application exists (T3). +// +// The one exception is reCAPTCHA, used to gate sign-up (and password reset) the +// same way it gates them in the browser. Its script comes from www.google.com, +// its challenge is a www.google.com iframe, and its assets sit on +// www.gstatic.com. These two hosts — and only these two — are allowed under +// `script-src`, `frame-src` and `img-src` for that purpose. It is a real, if +// small, dent in "no third-party code runs here": Google's reCAPTCHA script +// executes in the renderer. It is accepted deliberately so a native sign-up is +// gated like a web one without asking the user to do anything extra, and it is +// the *same* dependency the hub-served SPA already carries. If sign-up ever +// moves to a proof-of-work challenge, delete RECAPTCHA_SRC and the three +// directives that spread it, and the widget in auth-page.js with them. +const RECAPTCHA_SRC = 'https://www.google.com https://www.gstatic.com'; const CSP = [ "default-src 'none'", - "script-src 'self' 'wasm-unsafe-eval'", + `script-src 'self' 'wasm-unsafe-eval' ${RECAPTCHA_SRC}`, "style-src 'self' 'unsafe-inline'", - "img-src 'self' data: blob:", + `img-src 'self' data: blob: ${RECAPTCHA_SRC}`, "media-src 'self' blob:", "font-src 'self'", "connect-src 'self' https: wss:", "worker-src 'self'", + `frame-src ${RECAPTCHA_SRC}`, "frame-ancestors 'none'", "base-uri 'none'", "form-action 'none'", diff --git a/packages/meshbay-hub/tests/test_desktop_shell.py b/packages/meshbay-hub/tests/test_desktop_shell.py index 36b261e..b82804e 100644 --- a/packages/meshbay-hub/tests/test_desktop_shell.py +++ b/packages/meshbay-hub/tests/test_desktop_shell.py @@ -175,11 +175,17 @@ def _policy() -> str: """ import re source = _main() + # The array mixes plain strings and one `${RECAPTCHA_SRC}` template literal; + # resolve the constant so every directive reads as plain text. + rec = re.search(r"const RECAPTCHA_SRC = '([^']*)'", source) match = re.search(r"const CSP = \[(.*?)\]\.join", source, re.S) assert match, "no CSP constant in the main process" + body = match.group(1) + if rec: + body = body.replace("${RECAPTCHA_SRC}", rec.group(1)) return "; ".join( - line.strip().strip('",').strip('"') - for line in match.group(1).splitlines() if line.strip()) + line.strip().strip('`",').strip('`"') + for line in body.splitlines() if line.strip()) def _directive(name: str) -> str: @@ -193,18 +199,46 @@ def _directive(name: str) -> str: def test_the_hub_is_reachable_but_never_executable(): """ connect-src allows the hub's API and its signaling socket. script-src does - not include it: nothing the hub returns is ever executed. + not: nothing the hub returns is ever executed. The only script sources are + 'self', the wasm eval token, and the two reCAPTCHA hosts (see the next + test) — never a bare `https:` scheme, which would let the hub's own origin + serve script. """ connect = _directive("connect-src") assert "https:" in connect and "wss:" in connect script = _directive("script-src") assert script, "no script-src directive" - assert "https:" not in script, "the hub can serve script under this policy" + sources = script.split()[1:] # drop the "script-src" keyword itself + allowed = { + "'self'", "'wasm-unsafe-eval'", + "https://www.google.com", "https://www.gstatic.com", + } + assert set(sources) <= allowed, \ + f"unexpected script-src source: {set(sources) - allowed}" + assert "https:" not in sources, "a bare https: scheme lets the hub serve script" assert "'unsafe-eval'" not in script.replace("'wasm-unsafe-eval'", "") assert "default-src 'none'" in _policy() +def test_recaptcha_is_the_only_third_party_and_stays_scoped_to_it(): + """ + reCAPTCHA gates sign-up in the app the same way it does in the browser. + www.google.com and www.gstatic.com are allowed under script-src, frame-src + and img-src for that — and no other external origin appears anywhere in the + policy. Remove this expectation only alongside the reCAPTCHA widget. + """ + hosts = {"https://www.google.com", "https://www.gstatic.com"} + for directive in ("script-src", "frame-src", "img-src"): + srcs = set(_directive(directive).split()[1:]) + assert hosts <= srcs, f"{directive} is missing a reCAPTCHA host" + + for part in _policy().split(";"): + for tok in part.strip().split()[1:]: + if tok.startswith(("http://", "https://")): + assert tok in hosts, f"unexpected external origin in CSP: {tok}" + + # ── The bridge ────────────────────────────────────────────────────────────── def test_the_bridge_is_the_only_way_in(): -- cgit v1.2.3