Ship a Content-Security-Policy on the viewer (#117)

src-tauri/tauri.conf.json

@@ -12,7 +12,7 @@
     "withGlobalTauri": true,
     "windows": [],
     "security": {
-      "csp": null
+      "csp": "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:"
     }
   },
   "bundle": {

src/viewer.test.ts

@@ -318,6 +318,26 @@ bookmarked: 2025-01-15T00:00:00Z
   });
 });
 
+describe('content security policy (#117)', () => {
+  const viewerSource = readFileSync(join(__dirname, 'viewer.ts'), 'utf-8');
+
+  test('viewer HTML ships a Content-Security-Policy', () => {
+    expect(viewerSource).toContain("'Content-Security-Policy':");
+    // The load-bearing directives: no remote scripts, no plugins, no foreign frames beyond YouTube.
+    expect(viewerSource).toContain("script-src 'self' 'unsafe-inline'");
+    expect(viewerSource).toContain("object-src 'none'");
+    expect(viewerSource).toContain('frame-src https://www.youtube.com');
+    // Article assets must stay unrestricted or every remote image/podcast breaks.
+    expect(viewerSource).toContain('img-src * data: blob:');
+    expect(viewerSource).toContain('media-src * data: blob:');
+  });
+
+  test('tauri.conf.json no longer ships csp: null', () => {
+    const conf = JSON.parse(readFileSync(join(__dirname, '..', 'src-tauri', 'tauri.conf.json'), 'utf-8'));
+    expect(conf.app.security.csp).toBeTruthy();
+  });
+});
+
 describe('sync progress', () => {
   const rootDir = join(__dirname, '..');
 

src/viewer.ts

@@ -857,7 +857,18 @@ export function startViewer(initialOutputPath: string, port = 7777, openBrowser
     }
 
     if (url.pathname === '/' || url.pathname === '/index.html') {
-      res.writeHead(200, { 'Content-Type': 'text/html' });
+      // Second layer behind DOMPurify (#117): article content is untrusted
+      // remote HTML. Scripts/styles are fully inlined by embed-viewer.ts, so
+      // script-src needs no remote hosts; images/media/connect stay open for
+      // arbitrary article assets and HLS; frames are YouTube-embed only.
+      res.writeHead(200, {
+        'Content-Type': 'text/html',
+        'Content-Security-Policy':
+          "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; "
+          + "img-src * data: blob:; media-src * data: blob:; font-src 'self' data:; connect-src *; "
+          + "frame-src https://www.youtube.com https://www.youtube-nocookie.com; "
+          + "worker-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self'",
+      });
       res.end(VIEWER_HTML);
       return;
     }