dtourolle
38dd1129e5
`app.security.csp` was `null`, so the webview ran with no Content-Security-Policy
at all: any script that reached the web layer would have inherited the whole IPC
surface. There is no known injection path today (one app-owned `{@html}`, no
`innerHTML`/`eval`), so this is defence in depth rather than a fix for an open
hole.
`script-src 'self'` is the restrictive half — Tauri nonces SvelteKit's inline
bootstrap script at build time, so no `'unsafe-inline'` is needed — together with
`object-src`/`frame-src 'none'` and `base-uri 'self'`. `img-src`/`media-src`/
`connect-src` cannot be restrictive: the Jellyfin origin is typed in by the user
at run time and is routinely plain http on a LAN, so they allow `http:`/`https:`.
That is a wide grant for data, but it still bars `file:`/`filesystem:` and does
not touch script execution. A run-time policy naming the server exactly was
rejected: Tauri derives the header from immutable config when it serves the HTML,
so it would mean rebuilding config and reloading the webview on every server
change. `style-src` keeps `'unsafe-inline'` because Svelte compiles `style="…"`
attributes into markup; `worker-src`/`media-src` keep `blob:` for hls.js's
demuxer worker and its MSE object URL; `ipc:`/`http://ipc.localhost` keeps
`invoke` working. `devCsp` mirrors it with the eval/inline/websocket allowances
Vite's dev server needs.
The asset-protocol scope narrows from `$APPDATA/**` — the storage root holding
the SQLite database and the encrypted-token fallback file — to
`$APPDATA/thumbnails/**`. Since DR-137 moved downloaded media to the loopback
media server, `imageCache` is the only `convertFileSrc` caller left.
Needs manual verification on both platforms: thumbnails, online HLS video and
offline downloaded video cannot be exercised headlessly.
93 lines
3.6 KiB
TypeScript
93 lines
3.6 KiB
TypeScript
/**
|
|
* Guards the shipped webview security configuration.
|
|
*
|
|
* `csp` was `null` and the asset protocol was scoped to the whole storage root,
|
|
* which is the directory holding the SQLite database and the encrypted-token
|
|
* fallback file. Both are one-character regressions away and neither is visible
|
|
* in any behavioural test, so they are asserted here instead: the restrictive
|
|
* half of the policy must stay restrictive, and the permissive half must keep
|
|
* the schemes playback actually needs.
|
|
*
|
|
* TRACES: UR-012, UR-071 | DR-198 | UT-193
|
|
*/
|
|
|
|
import { describe, it, expect } from "vitest";
|
|
import { readFileSync } from "fs";
|
|
import { resolve } from "path";
|
|
|
|
const config = JSON.parse(
|
|
readFileSync(resolve(__dirname, "../src-tauri/tauri.conf.json"), "utf-8")
|
|
);
|
|
|
|
const security = config.app.security;
|
|
|
|
/** Split a CSP string into `directive -> sources`. */
|
|
function directives(csp: string): Record<string, string[]> {
|
|
const map: Record<string, string[]> = {};
|
|
for (const part of csp.split(";")) {
|
|
const [name, ...sources] = part.trim().split(/\s+/);
|
|
if (name) map[name] = sources;
|
|
}
|
|
return map;
|
|
}
|
|
|
|
describe("tauri.conf.json CSP", () => {
|
|
it("is set at all — a null CSP hands any injected script the full IPC surface", () => {
|
|
expect(typeof security.csp).toBe("string");
|
|
expect(security.csp.length).toBeGreaterThan(0);
|
|
});
|
|
|
|
const csp = directives(security.csp as string);
|
|
|
|
it("locks down script execution", () => {
|
|
// Tauri injects a nonce for SvelteKit's inline bootstrap script at build
|
|
// time, so 'self' alone is enough and inline/eval must never be re-added.
|
|
expect(csp["script-src"]).toEqual(["'self'"]);
|
|
expect(csp["object-src"]).toEqual(["'none'"]);
|
|
expect(csp["frame-src"]).toEqual(["'none'"]);
|
|
expect(csp["base-uri"]).toEqual(["'self'"]);
|
|
expect(csp["default-src"]).toEqual(["'self'"]);
|
|
});
|
|
|
|
it("keeps the schemes playback and thumbnails depend on", () => {
|
|
// The asset protocol under both names convertFileSrc emits.
|
|
expect(csp["img-src"]).toContain("asset:");
|
|
expect(csp["img-src"]).toContain("http://asset.localhost");
|
|
expect(csp["media-src"]).toContain("asset:");
|
|
// hls.js: MSE object URLs, and its demuxer worker built from a blob.
|
|
expect(csp["media-src"]).toContain("blob:");
|
|
expect(csp["worker-src"]).toContain("blob:");
|
|
// The token-guarded loopback media server (DR-137).
|
|
expect(csp["media-src"]).toContain("http://127.0.0.1:*");
|
|
// Tauri's invoke transport.
|
|
expect(csp["connect-src"]).toContain("ipc:");
|
|
expect(csp["connect-src"]).toContain("http://ipc.localhost");
|
|
// The user's Jellyfin server: an arbitrary run-time origin, http on a LAN.
|
|
for (const directive of ["img-src", "media-src", "connect-src"]) {
|
|
expect(csp[directive]).toContain("http:");
|
|
expect(csp[directive]).toContain("https:");
|
|
}
|
|
});
|
|
|
|
it("never widens a data directive into script execution", () => {
|
|
for (const [name, sources] of Object.entries(csp)) {
|
|
if (name === "script-src" || name === "worker-src") {
|
|
expect(sources).not.toContain("'unsafe-eval'");
|
|
expect(sources).not.toContain("'unsafe-inline'");
|
|
}
|
|
// A bare `*` would re-admit every scheme, including file:.
|
|
expect(sources).not.toContain("*");
|
|
}
|
|
});
|
|
});
|
|
|
|
describe("tauri.conf.json asset protocol scope", () => {
|
|
const scope: string[] = security.assetProtocol.scope;
|
|
|
|
it("covers only the thumbnail cache, not the storage root", () => {
|
|
expect(scope).toEqual(["$APPDATA/thumbnails/**"]);
|
|
// The database and the encrypted-token fallback live directly in $APPDATA.
|
|
expect(scope).not.toContain("$APPDATA/**");
|
|
});
|
|
});
|