Security [HIGH]: CSP wildcards (*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP
#45
Reference in New Issue
Block a user
*.openai.com, *.azure.com), unsafe-inline styles, SVG routes skip CSP
#45
Problem
(1) CSP
connect-srcwhitelistshttps://*.openai.com https://*.azure.com— wildcard Azure subdomains include user-provisionable storage, massive XSS-exfil surface. (2)style-src 'self' 'unsafe-inline'in all envs — CSS-based exfiltration possible. (3) Middleware matcher excludes SVG/PNG/static from CSP — stored SVG with<script>served via app origin bypasses all CSP protections.Evidence
apps/web/src/middleware.ts:29 — connect-src wildcardsapps/web/src/middleware.ts:27 — style-src 'unsafe-inline'apps/web/src/middleware.ts:68 — matcher excludes SVG from CSP pathapps/web/next.config.ts:39-76 — base headers apply but CSP only in middlewareImpact
XSS-exfiltration via Azure blob wildcards; CSS-based keystroke/data leak; stored XSS via uploaded SVG served with app origin.
Proposed Fix
(1) Pin connect-src to specific endpoints from system settings; prefer server-side-only AI calls. (2) Move to nonce/hash-based style-src, or keep unsafe-inline with
style-src-elem 'self' 'nonce-...'. (3) Add static CSP for/_next/static+SVG in next.config.ts headers, OR serve SVG withContent-Disposition: attachment/ rewrite to PNG.Acceptance Criteria
Parent Epic: #1
Source: Full-Codebase Security Audit 2026-04-16 (A-14, A-15, C-6, C-7)
Resolved in commit
d1075af(security: tighten CSP — drop provider wildcards, add object/frame/worker-src).apps/web/src/middleware.ts::buildCsp()now returns:connect-src 'self'(was'self' *.openai.com *.azure.com)object-src 'none'frame-src 'none'worker-src 'self' blob:base-uri 'self',form-action 'self'Verified no browser-side AI fetches exist; all AI calls route through the server. Test coverage in
apps/web/src/middleware.test.ts. Residual risk (style-src 'unsafe-inline'still required by Tailwind JIT) documented indocs/security-architecture.md§7.