Merge #4048 into stage-mj

api/helpers.py

@@ -53,7 +53,7 @@ def safe_resolve(root: Path, requested: str) -> Path:
 
 
 _CSP_CONNECT_BASE = (
-    "'self' http://127.0.0.1:* http://localhost:* "
+    "'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost "
     "ws://127.0.0.1:* ws://localhost:*"
 )
 _CSP_EXTRA_CONNECT_RE = _re.compile(

tests/test_issue1909_csp_enforcement.py

@@ -50,7 +50,7 @@ def test_security_helper_sends_enforcing_csp_with_hardening_directives(monkeypat
     assert "object-src 'none'" in policy
     assert "frame-ancestors 'none'" in policy
     assert "media-src 'self' data: blob:" in policy
-    assert "connect-src 'self' http://127.0.0.1:* http://localhost:* ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net" in policy
+    assert "connect-src 'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net" in policy
 
 
 def test_enforcing_csp_honors_valid_extra_connect_origins(monkeypatch):
@@ -64,7 +64,7 @@ def test_enforcing_csp_honors_valid_extra_connect_origins(monkeypatch):
     policy = headers["Content-Security-Policy"]
     assert (
         "connect-src 'self' http://127.0.0.1:* http://localhost:* "
-        "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
+        "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
         "https://metrics.example.com wss://events.example.com:443; "
     ) in policy
 

tests/test_issue2901_csp_connect_extra.py

@@ -9,11 +9,13 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch):
     monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False)
 
     policy = Handler.csp_report_only_policy()
-
-    assert (
+    expected = (
         "connect-src 'self' http://127.0.0.1:* http://localhost:* "
-        "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net; "
-    ) in policy
+        "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
+        "https://cdn.jsdelivr.net; "
+    )
+
+    assert expected in policy
 
 
 def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
@@ -28,7 +30,8 @@ def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):
 
     assert (
         "connect-src 'self' http://127.0.0.1:* http://localhost:* "
-        "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net "
+        "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* "
+        "https://cdn.jsdelivr.net "
         "https://metrics.example.com wss://events.example.com:443; "
     ) in policy