From 4d4dfde1de89ced7a37948c17c69f3d7efec83b6 Mon Sep 17 00:00:00 2001 From: Avi Date: Fri, 21 Aug 2026 13:53:45 -0500 Subject: [PATCH] Enforce header-based CSP and block window open/navigation --- frontend/electron/main.ts | 71 ++++++++++++++++++++++++++++++++++++++- frontend/index.html | 4 --- 2 files changed, 70 insertions(+), 5 deletions(-) diff --git a/frontend/electron/main.ts b/frontend/electron/main.ts index 92ee9cb..55e18ea 100644 --- a/frontend/electron/main.ts +++ b/frontend/electron/main.ts @@ -1,4 +1,4 @@ -import { app, BrowserWindow, clipboard, dialog, ipcMain, protocol } from 'electron'; +import { app, BrowserWindow, clipboard, dialog, ipcMain, protocol, shell } from 'electron'; import { spawn, type ChildProcess } from 'node:child_process'; import { randomBytes } from 'node:crypto'; import { readFileSync } from 'node:fs'; @@ -26,6 +26,42 @@ protocol.registerSchemesAsPrivileged([ { scheme: 'app', privileges: { standard: true, secure: true, supportFetchAPI: true } }, ]); +/** + * Content-Security-Policy applied to every page this app loads. + * + * The production policy forbids inline scripts entirely (the Vite bundle is + * external), so an injected `