4 people f48fe95ac4 fix(security): add Content-Security-Policy header to web gateway (#966) ...

* fix(security): add Content-Security-Policy header to web gateway

The web gateway set X-Frame-Options and X-Content-Type-Options but had
no Content-Security-Policy header. Without CSP, there is no browser-
enforced mitigation against XSS attacks. This adds a tailored CSP that
matches the resources the frontend actually loads.

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

* fix(security): address CSP review feedback

- Remove cdnjs.cloudflare.com from script-src (not used in codebase)
- Add explicit object-src 'none' per security best practice
- Add regression test asserting CSP header presence and directives

Co-Authored-By: Claude Sonnet 4.6 <[email protected]>

---------

Co-authored-by: Gabe Hamilton <[email protected]>
Co-authored-by: Claude Sonnet 4.6 <[email protected]>

2026-03-12 00:55:38 +00:00

..

handlers

fix(agent): block thread_id-based context pollution across users (#760)

2026-03-11 16:52:31 -07:00

static

fix(security): replace regex HTML sanitizer with DOMPurify to prevent XSS (#510)

2026-03-11 15:55:35 -07:00

auth.rs

refactor: centralize test credential constants into testing::credentials (#829)

2026-03-10 13:25:32 -07:00

CLAUDE.md

fix(test): stabilize openai compat oversized-body regression (#839)

2026-03-11 17:03:12 -07:00

log_layer.rs

feat(web): display logs newest-first in web gateway UI (#369)

2026-02-25 16:00:09 -08:00

mod.rs

Add generic host-verified /webhook/tools/{tool} ingress (#757)

2026-03-11 03:36:25 +00:00

openai_compat.rs

feat: WASM channel attachments with LLM pipeline integration (#596)

2026-03-07 18:01:40 +00:00

server.rs

fix(security): add Content-Security-Policy header to web gateway (#966)

2026-03-12 00:55:38 +00:00

sse.rs

feat: full image support across all channels (#725)

2026-03-09 03:41:27 +00:00

test_helpers.rs

feat: add channel-relay integration for Slack (#790)

2026-03-10 16:34:54 -07:00

types.rs

Add event-triggered routines and workflow skill templates (#756)

2026-03-10 11:08:04 -07:00

util.rs

fix: preserve tool-call history across thread hydration (#568) (#670)

2026-03-09 08:36:07 -07:00

ws.rs

feat(extensions): unify auth and configure into single entrypoint (#677)

2026-03-11 16:01:41 -07:00