electron-rare/Aperant
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(csp): allow external HTTPS images in Content-Security-Policy (#549)

Browse Source 
* fix(csp): allow external HTTPS images in Content-Security-Policy

Update img-src directive to include 'https:' allowing images from external
services like Supabase Storage to load in GitHub issue previews.

This enables automated pipelines (e.g., TestFlight feedback to GitHub issues)
that host screenshots on external storage to display correctly within Auto Claude.

Fixes image loading for:
- Supabase Storage URLs
- Any other HTTPS-hosted images in GitHub issues

Before: img-src 'self' data: blob:
After:  img-src 'self' data: blob: https:

* fix(csp): narrow img-src to specific trusted domains

Per reviewer feedback, replaced blanket https: with explicit whitelist:
- https://*.githubusercontent.com (GitHub images/avatars)
- https://*.supabase.co (Supabase Storage for TestFlight feedback)

This addresses security concerns while maintaining the use case.

Co-authored-by: adryserage <adryserage@users.noreply.github.com>

---------

Co-authored-by: adryserage <adryserage@users.noreply.github.com>
Co-authored-by: Alex <63423455+AlexMadera@users.noreply.github.com>
This commit is contained in:
Michael Ludlow
2026-01-02 02:30:21 -05:00
committed by GitHub
parent 344ec65eed
commit 3db02c5d64
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/frontend/src/renderer/index.html
+1 -1
View File
@@ -3,7 +3,7 @@
<head> <head>
<meta charset="UTF-8" /> <meta charset="UTF-8" />
<meta name="viewport" content="width=device-width, initial-scale=1.0" /> <meta name="viewport" content="width=device-width, initial-scale=1.0" />
<meta http-equiv="Content-Security-Policy" content="default-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob:" /> <meta http-equiv="Content-Security-Policy" content="default-src 'self' https://fonts.googleapis.com https://fonts.gstatic.com; script-src 'self'; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; img-src 'self' data: blob: https://*.githubusercontent.com https://*.supabase.co" />
<link rel="preconnect" href="https://fonts.googleapis.com"> <link rel="preconnect" href="https://fonts.googleapis.com">
<link rel="preconnect" href="https://fonts.gstatic.com" crossorigin> <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet"> <link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;500;600;700&family=JetBrains+Mono:wght@400;500&display=swap" rel="stylesheet">