From ddcaf6091c99e91d425beb0dca12c4f3173e9508 Mon Sep 17 00:00:00 2001 From: Rod Boev Date: Fri, 12 Jun 2026 07:50:43 -0400 Subject: [PATCH 1/2] fix(#4040): allow Tauri IPC host in connect-src --- api/helpers.py | 2 +- tests/test_issue2901_csp_connect_extra.py | 14 +++++++++----- 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/api/helpers.py b/api/helpers.py index 544eb811..c9a84a81 100644 --- a/api/helpers.py +++ b/api/helpers.py @@ -53,7 +53,7 @@ def safe_resolve(root: Path, requested: str) -> Path: _CSP_CONNECT_BASE = ( - "'self' http://127.0.0.1:* http://localhost:* " + "'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost " "ws://127.0.0.1:* ws://localhost:*" ) _CSP_EXTRA_CONNECT_RE = _re.compile( diff --git a/tests/test_issue2901_csp_connect_extra.py b/tests/test_issue2901_csp_connect_extra.py index 8056f10f..a61fe4bc 100644 --- a/tests/test_issue2901_csp_connect_extra.py +++ b/tests/test_issue2901_csp_connect_extra.py @@ -9,11 +9,14 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch): monkeypatch.delenv("HERMES_WEBUI_CSP_CONNECT_EXTRA", raising=False) policy = Handler.csp_report_only_policy() - - assert ( + expected = ( "connect-src 'self' http://127.0.0.1:* http://localhost:* " - "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net; " - ) in policy + "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* " + "https://cdn.jsdelivr.net; " + ) + + assert expected in policy + assert "http://ipc.localhost" in policy def test_csp_connect_src_includes_valid_extra_origins(monkeypatch): @@ -28,7 +31,8 @@ def test_csp_connect_src_includes_valid_extra_origins(monkeypatch): assert ( "connect-src 'self' http://127.0.0.1:* http://localhost:* " - "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net " + "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* " + "https://cdn.jsdelivr.net " "https://metrics.example.com wss://events.example.com:443; " ) in policy From e73cf3d610618f5204444d4b616bacf97dfee908 Mon Sep 17 00:00:00 2001 From: Rod Boev Date: Fri, 12 Jun 2026 08:18:04 -0400 Subject: [PATCH 2/2] test(csp): pin ipc localhost across enforcing coverage (#4040) --- tests/test_issue1909_csp_enforcement.py | 4 ++-- tests/test_issue2901_csp_connect_extra.py | 1 - 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/tests/test_issue1909_csp_enforcement.py b/tests/test_issue1909_csp_enforcement.py index 2d8731ca..70976ed9 100644 --- a/tests/test_issue1909_csp_enforcement.py +++ b/tests/test_issue1909_csp_enforcement.py @@ -50,7 +50,7 @@ def test_security_helper_sends_enforcing_csp_with_hardening_directives(monkeypat assert "object-src 'none'" in policy assert "frame-ancestors 'none'" in policy assert "media-src 'self' data: blob:" in policy - assert "connect-src 'self' http://127.0.0.1:* http://localhost:* ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net" in policy + assert "connect-src 'self' http://127.0.0.1:* http://localhost:* http://ipc.localhost ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net" in policy def test_enforcing_csp_honors_valid_extra_connect_origins(monkeypatch): @@ -64,7 +64,7 @@ def test_enforcing_csp_honors_valid_extra_connect_origins(monkeypatch): policy = headers["Content-Security-Policy"] assert ( "connect-src 'self' http://127.0.0.1:* http://localhost:* " - "ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net " + "http://ipc.localhost ws://127.0.0.1:* ws://localhost:* https://cdn.jsdelivr.net " "https://metrics.example.com wss://events.example.com:443; " ) in policy diff --git a/tests/test_issue2901_csp_connect_extra.py b/tests/test_issue2901_csp_connect_extra.py index a61fe4bc..7a441ce5 100644 --- a/tests/test_issue2901_csp_connect_extra.py +++ b/tests/test_issue2901_csp_connect_extra.py @@ -16,7 +16,6 @@ def test_csp_connect_src_default_header_unchanged(monkeypatch): ) assert expected in policy - assert "http://ipc.localhost" in policy def test_csp_connect_src_includes_valid_extra_origins(monkeypatch):