[Phase 5] Harden CSP, imports, rendering, and extension boundaries #33

New issue

Closed

opened 2026-07-25 21:57:13 +00:00 by lost-rob0t · 0 comments

lost-rob0t commented

2026-07-25 21:57:13 +00:00

(Migrated from github.com)

Parent: #2
Depends on: #11, #19, #22, #29, #30, #31

Scope

Define a restrictive Content Security Policy without unsafe eval.
Sanitize labels, rich text, imported HTML, URLs, map metadata, and document previews.
Validate MIME type, extension, size, nesting depth, record count, and decompression limits on imports.
Restrict worker and integration endpoints through explicit capability and origin configuration.
Prevent exported workspaces from containing secrets or live authentication state.
Add dependency and supply-chain scanning to CI.

Acceptance criteria

The production build runs under the documented CSP.
Imported active content cannot execute in the application origin.
Oversized or maliciously nested files fail before resource exhaustion.
Local actions cannot escape their declared worker capabilities.
Security-focused fixtures and browser tests run in CI.

Parent: #2 Depends on: #11, #19, #22, #29, #30, #31 ## Scope - Define a restrictive Content Security Policy without unsafe eval. - Sanitize labels, rich text, imported HTML, URLs, map metadata, and document previews. - Validate MIME type, extension, size, nesting depth, record count, and decompression limits on imports. - Restrict worker and integration endpoints through explicit capability and origin configuration. - Prevent exported workspaces from containing secrets or live authentication state. - Add dependency and supply-chain scanning to CI. ## Acceptance criteria - The production build runs under the documented CSP. - Imported active content cannot execute in the application origin. - Oversized or maliciously nested files fail before resource exhaustion. - Local actions cannot escape their declared worker capabilities. - Security-focused fixtures and browser tests run in CI.