Problem
Final review of transport epic PR #2035 at exact head d4226b2 found a renderer security regression (review finding F1, comment 5545248706). apps/desktop/renderer.html broadens connect-src to scheme-wide http: and ws:, which permits arbitrary cleartext remote/LAN destinations. The runtime endpoint validator permits cleartext only for normalized loopback endpoints, while remote instances and ProPR Connect tunnel endpoints use HTTPS/WSS.
Required correction
Tighten the packaged renderer CSP so:
- remote API/tunnel instances remain supported over
https: and wss:;
- cleartext
http: and ws: are allowed only for the supported loopback authorities (localhost, IPv4 loopback, and IPv6 loopback as accepted by the endpoint normalizer), including required development/local ports;
- arbitrary cleartext remote and LAN hosts are rejected;
- production renderer, IPC, session permission, credential injection, pairing approval, and navigation boundaries remain fail-closed;
- no unsafe inline/eval or broad default/connect source is introduced.
Use a static narrowly scoped allowlist if it accurately covers the normalizer; otherwise implement a validated per-profile policy without creating a startup race. Add focused CSP policy coverage proving supported loopback HTTP/WS forms and remote HTTPS/WSS forms pass, while non-loopback cleartext and deceptive hostname forms fail. Preserve Linux/macOS packaging and ProPR Connect tunnel behavior. Windows is out of scope.
Acceptance
Final review F1 is resolved; focused security tests, full suite, CodeQL, Validate Changes, packaged Connect Darwin/Linux x64+ARM64, and unsigned Darwin/Linux x64+ARM64 all pass on the combined transport head.
Problem
Final review of transport epic PR #2035 at exact head d4226b2 found a renderer security regression (review finding F1, comment 5545248706).
apps/desktop/renderer.htmlbroadensconnect-srcto scheme-widehttp:andws:, which permits arbitrary cleartext remote/LAN destinations. The runtime endpoint validator permits cleartext only for normalized loopback endpoints, while remote instances and ProPR Connect tunnel endpoints use HTTPS/WSS.Required correction
Tighten the packaged renderer CSP so:
https:andwss:;http:andws:are allowed only for the supported loopback authorities (localhost, IPv4 loopback, and IPv6 loopback as accepted by the endpoint normalizer), including required development/local ports;Use a static narrowly scoped allowlist if it accurately covers the normalizer; otherwise implement a validated per-profile policy without creating a startup race. Add focused CSP policy coverage proving supported loopback HTTP/WS forms and remote HTTPS/WSS forms pass, while non-loopback cleartext and deceptive hostname forms fail. Preserve Linux/macOS packaging and ProPR Connect tunnel behavior. Windows is out of scope.
Acceptance
Final review F1 is resolved; focused security tests, full suite, CodeQL, Validate Changes, packaged Connect Darwin/Linux x64+ARM64, and unsigned Darwin/Linux x64+ARM64 all pass on the combined transport head.