David/HERMES-GIELIE
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix(#4040): allow Tauri IPC host in connect-src

Browse source
This commit is contained in:
Rod Boev 2026-06-12 07:50:43 -04:00
parent df6cfd0a15
commit ddcaf6091c
2 changed files with 10 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
api/helpers.py
View file

@ -53,7 +53,7 @@ def safe_resolve(root: Path, requested: str) -> Path:
_CSP_CONNECT_BASE = (
"'self' http://127.0.0.1:* http://localhost:* "
"'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost "
"ws://127.0.0.1:* ws://localhost:*"
)
_CSP_EXTRA_CONNECT_RE = _re.compile(

14
tests/test_issue2901_csp_connect_extra.py
View file

@ -9,11 +9,14 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch):
monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False)
policy = Handler.csp_report_only_policy()
assert (
expected = (
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
"ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net; "
) in policy
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
"https://cdn.jsdelivr.net; "
)
assert expected in policy
assert "http://ipc.localhost" in policy
def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
@ -28,7 +31,8 @@ def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
assert (
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
"ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
"https://cdn.jsdelivr.net "
"https://metrics.example.com wss://events.example.com:443; "
) in policy