Merge pull request #119 from YahyaZekry/codex/allow-local-media-csp

fix(media): allow localhost stream URLs through CSP

src-tauri/tauri.conf.json

@@ -25,7 +25,7 @@
       }
     ],
     "security": {
-      "csp": "default-src 'self' ipc:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ipc:; img-src 'self' asset: data: blob: https:; media-src 'self' asset: blob: https:; font-src 'self' data:; frame-src 'self' https://ghbtns.com;",
+      "csp": "default-src 'self' ipc:; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ipc: http://127.0.0.1:*; img-src 'self' asset: data: blob: https:; media-src 'self' asset: blob: https: http://127.0.0.1:*; font-src 'self' data:; frame-src 'self' https://ghbtns.com;",
       "assetProtocol": {
         "enable": true,
         "scope": {
@@ -95,4 +95,4 @@
       }
     }
   }
-}
+}

src/lib/security-config.test.ts

@@ -17,6 +17,20 @@ describe("Desktop Security Configuration & Build Setup", () => {
     expect(csp).not.toContain("'unsafe-eval'");
   });
 
+  it("permits the loopback media bridge without allowing arbitrary HTTP origins", () => {
+    const csp = JSON.parse(fs.readFileSync(tauriConfPath, "utf-8")).app.security.csp as string;
+    const directives = new Map(csp.split(";").filter((part) => part.trim()).map((part) => {
+      const [name, ...sources] = part.trim().split(/\s+/);
+      return [name, sources];
+    }));
+    for (const name of ["connect-src", "media-src"]) {
+      const sources = directives.get(name) ?? [];
+      expect(sources.filter((source) => source.startsWith("http:"))).toEqual(["http://127.0.0.1:*"]);
+      expect(sources).not.toContain("*");
+    }
+    expect(directives.get("script-src")).not.toContain("http://127.0.0.1:*");
+  });
+
   it("should not allow wildcard '**' filesystem access in assetProtocol scope", () => {
     const tauriConf = JSON.parse(fs.readFileSync(tauriConfPath, "utf-8"));
     const allowList: string[] = tauriConf.app?.security?.assetProtocol?.scope?.allow ?? [];