gooneyryan/hermes-webui
1
0
Fork 0
mirror of https://github.com/nesquena/hermes-webui.git synced 2026-07-21 07:00:23 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(#4040): allow Tauri IPC host in connect-src

Browse Source
This commit is contained in:
Rod Boev
2026-06-12 07:50:43 -04:00
parent df6cfd0a15
commit ddcaf6091c
2 changed files with 10 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
api/helpers.py
+1 -1
View File
@@ -53,7 +53,7 @@ def safe_resolve(root: Path, requested: str) -> Path:
_CSP_CONNECT_BASE = (
"'self' http://127.0.0.1:* http://localhost:* "
"'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost "
"ws://127.0.0.1:* ws://localhost:*"
)
_CSP_EXTRA_CONNECT_RE = _re.compile(
tests/test_issue2901_csp_connect_extra.py
+9 -5
View File
@@ -9,11 +9,14 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch):
monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False)
policy = Handler.csp_report_only_policy()
assert (
expected = (
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
"ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net; "
) in policy
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
"https://cdn.jsdelivr.net; "
)
assert expected in policy
assert "http://ipc.localhost" in policy
def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
@@ -28,7 +31,8 @@ def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
assert (
"connect-src 'self' http://127.0.0.1:* http://localhost:* "
"ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
"http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
"https://cdn.jsdelivr.net "
"https://metrics.example.com wss://events.example.com:443; "
) in policy