From ddcaf6091c99e91d425beb0dca12c4f3173e9508 Mon Sep 17 00:00:00 2001 From: Rod Boev Date: Fri, 12 Jun 2026 07:50:43 -0400 Subject: [PATCH] fix(#4040): allow Tauri IPC host in connect-src --- api/helpers.py | 2 +- tests/test_issue2901_csp_connect_extra.py | 14 +++++++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/api/helpers.py b/api/helpers.py index 544eb811f..c9a84a816 100644 --- a/api/helpers.py +++ b/api/helpers.py @@ -53,7 +53,7 @@ def safe_resolve(root: Path, requested: str) -> Path: _CSP_CONNECT_BASE = ( - "'self' http://127.0.0.1:* http://localhost:* " + "'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost " "ws://127.0.0.1:* ws://localhost:*" ) _CSP_EXTRA_CONNECT_RE = _re.compile( diff --git a/tests/test_issue2901_csp_connect_extra.py b/tests/test_issue2901_csp_connect_extra.py index 8056f10f8..a61fe4bcd 100644 --- a/tests/test_issue2901_csp_connect_extra.py +++ b/tests/test_issue2901_csp_connect_extra.py @@ -9,11 +9,14 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch): monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False) policy = Handler.csp_report_only_policy() - - assert ( + expected = ( "connect-src 'self' http://127.0.0.1:* http://localhost:* " - "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net; " - ) in policy + "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* " + "https://cdn.jsdelivr.net; " + ) + + assert expected in policy + assert "http://ipc.localhost" in policy def test_csp_connect_src_includes_valid_extra_origins(monkeypatch): @@ -28,7 +31,8 @@ def test_csp_connect_src_includes_valid_extra_origins(monkeypatch): assert ( "connect-src 'self' http://127.0.0.1:* http://localhost:* " - "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net " + "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* " + "https://cdn.jsdelivr.net " "https://metrics.example.com wss://events.example.com:443; " ) in policy