--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Commit a87455b7cf0009fe837830934040ff7b9597f72b
Parents : bec1129
Author : Ivan <ivan@quad4.io>
Signature : Signature validation error
Date : 2026-04-23T17:53:16-05:00
fix(electron): update Content Security Policy to include 'blob:' for script execution and enhance CSP logic in related files
Changes
5 files changed, 15 insertions(+), 6 deletions(-)
Diff
diff --git a/electron/crash.html b/electron/crash.html
index 14d9ba16..85374ced 100644
--- a/electron/crash.html
+++ b/electron/crash.html
@@ -4,7 +4,7 @@
<meta charset="UTF-8" />
<meta
http-equiv="Content-Security-Policy"
- content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
+ content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data:;"
/>
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
<title>MeshChatX - Crash Report</title>
diff --git a/electron/loading.html b/electron/loading.html
index d81aa6d8..537a9ff9 100644
--- a/electron/loading.html
+++ b/electron/loading.html
@@ -3,7 +3,7 @@
<meta charset="UTF-8" />
<meta
http-equiv="Content-Security-Policy"
- content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' http://127.0.0.1:9337 https://127.0.0.1:9337 http://localhost:9337 https://localhost:9337;"
+ content="default-src 'self'; script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; img-src 'self' data:; connect-src 'self' http://127.0.0.1:9337 https://127.0.0.1:9337 http://localhost:9337 https://localhost:9337;"
/>
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
<meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" />
diff --git a/electron/main.js b/electron/main.js
index 5ac692ec..6e177cab 100644
--- a/electron/main.js
+++ b/electron/main.js
@@ -506,7 +506,7 @@ app.whenReady().then(async () => {
// Define a robust fallback CSP that matches our backend's policy
const fallbackCsp = [
"default-src 'self'",
- "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval'",
+ "script-src 'self' 'unsafe-inline' 'wasm-unsafe-eval' blob:",
"style-src 'self' 'unsafe-inline'",
"img-src 'self' data: blob: https://*.tile.openstreetmap.org https://tile.openstreetmap.org https://*.cartocdn.com https://tiles.openfreemap.org https://*.openfreemap.org",
"font-src 'self' data: https://tiles.openfreemap.org https://*.openfreemap.org",
diff --git a/meshchatx/meshchat.py b/meshchatx/meshchat.py
index 33d4aed1..c01f6e22 100644
--- a/meshchatx/meshchat.py
+++ b/meshchatx/meshchat.py
@@ -11593,10 +11593,16 @@ class ReticulumMeshChat:
if path.startswith("/reticulum-docs/") or path.startswith(
"/rnode-flasher/"
):
- script_sources = ["'self'", "'unsafe-inline'", "'wasm-unsafe-eval'"]
+ # blob: AudioWorklet addModule(blob:...) and similar dynamic scripts
+ script_sources = [
+ "'self'",
+ "'unsafe-inline'",
+ "'wasm-unsafe-eval'",
+ "blob:",
+ ]
else:
- # wasm-unsafe-eval: Codec2 / sox Emscripten WASM (sox.js) without full unsafe-eval
- script_sources = ["'self'", "'wasm-unsafe-eval'"]
+ # wasm-unsafe-eval: Codec2 / sox Emscripten WASM; blob: worklets from object URLs
+ script_sources = ["'self'", "'wasm-unsafe-eval'", "blob:"]
style_sources = ["'self'", "'unsafe-inline'"]
if self.current_context and self.current_context.config:
diff --git a/tests/backend/test_csp_logic.py b/tests/backend/test_csp_logic.py
index fd1aa6a5..457188ca 100644
--- a/tests/backend/test_csp_logic.py
+++ b/tests/backend/test_csp_logic.py
@@ -1,5 +1,6 @@
# SPDX-License-Identifier: 0BSD
+import re
from unittest.mock import AsyncMock, MagicMock, patch
import pytest
@@ -67,6 +68,8 @@ async def test_csp_header_logic(mock_rns_minimal, tmp_path):
assert "https://tiles.example.com" in csp
assert "default-src 'self'" in csp
assert "wasm-unsafe-eval" in csp
+ m = re.search(r"script-src([^;]+);", csp)
+ assert m is not None and "blob:" in m.group(1)
@pytest.mark.asyncio
──────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────