merge: restrictive CSP and narrowed asset scope (C1, C2)

Browse Source

Set a CSP with script-src 'self' (Tauri nonces the one inline bootstrap script),
object-src/frame-src 'none', and necessarily-permissive img/media/connect for the
user-supplied Jellyfin origin. Narrow assetProtocol $APPDATA/** -> thumbnails/**,
which is convertFileSrc's only remaining caller.

Conflict resolution: scripts/extract-traces.test.ts pinned counts summed rather
than side-picked — DR-189 and DR-198 were added independently on two branches,
so DR 187 -> 189 and total 330 -> 332. docs/traceability.md regenerated.

...

This commit is contained in:

dtourolle

2026-08-16 23:01:50 +02:00

parent a93cee9241 38dd1129e5

commit c9f33ae6a4

10 changed files with 4799 additions and 4085 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

docs/traceability.md

+4135 -4062

File diff suppressed because it is too large Load Diff