BitSquare/Codeman
2
0
Fork 0
mirror of https://github.com/Ark0N/Codeman.git synced 2026-09-30 12:39:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

fix(csp): drop now-unused gesture CDN connect-src entries (self-hosted MediaPipe)

Browse Source 
MediaPipe's wasm runtime + model are served same-origin from /gesture/, so the
gesture CSP no longer needs https://cdn.jsdelivr.net / https://storage.googleapis
.com in connect-src ('self' covers same-origin). Kept 'wasm-unsafe-eval'
(script-src, WASM compile) and worker-src 'self' blob: (MediaPipe blob workers).
Codeman's base jsdelivr entries (script/style/font-src) are unchanged — those
aren't gesture's.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Ark0N
2026-06-08 01:29:26 +02:00
co-authored by Claude Opus 4.8
parent eea84db05e
commit 8dc850f845
1 changed files with 5 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/web/middleware/auth.ts
+5 -5
View File
@@ -155,14 +155,14 @@ export function registerAuthMiddleware(app: FastifyInstance, https: boolean): Au
*/
export function registerSecurityHeaders(app: FastifyInstance, https: boolean): void {
// Gesture-control overlay (opt-in via CODEMAN_GESTURE=1) runs MediaPipe, which
// needs WebAssembly eval and must fetch its wasm/model from the pinned CDNs.
// Computed once; OFF by default so the production CSP is byte-for-byte unchanged.
// needs WebAssembly eval (script-src) and blob workers (worker-src). Its wasm
// runtime + model are self-hosted under /gesture/ (same-origin, covered by
// 'self'), so no CDN connect-src entries are needed. OFF by default so the
// production CSP is byte-for-byte unchanged.
const gesture = process.env.CODEMAN_GESTURE === '1';
const scriptSrc =
"script-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net" + (gesture ? " 'wasm-unsafe-eval'" : '');
const connectSrc =
"connect-src 'self' wss://api.deepgram.com" +
(gesture ? ' https://cdn.jsdelivr.net https://storage.googleapis.com' : '');
const connectSrc = "connect-src 'self' wss://api.deepgram.com";
const workerSrc = gesture ? "; worker-src 'self' blob:" : '';
const csp =
`default-src 'self'; ${scriptSrc}; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net; ` +