Adopt Astro 7.1 finer-grained CSP directives to de-brittle the captcha CSP #64

Nytt ärende

Stängd

öppnade 2026-07-19 06:58:59 +00:00 av supernaut · 0 kommentarer

supernaut kommenterad

2026-07-19 06:58:59 +00:00

Ägare

Severity: LOW/MEDIUM (robustness) — Astro 7.1 adoption, pre-onboarding audit (2026-07-19). Repo is already on astro 7.1.1, so this is adoption, not a version bump (no migration risk).

Astro 7.1 adds finer-grained CSP directives (script-src-elem, script-src-attr, style-src-elem, style-src-attr). Today src/lib/cap-widget-csp.ts:18-45 string-scrapes the minified Cap widget source to hash its shadow-root inline <style> — brittle and fail-closed on any upstream restyle (captcha loses styling). The new directives let us allow inline styles precisely without weakening script-src, so the fragile hash extraction can be dropped.

Ask

Add the finer-grained directives under security.csp.directives in astro.config.mjs; remove/simplify cap-widget-csp.ts; verify with build + preview (CSP is off in dev). Optionally add deferRender to the glob content loaders in src/content.config.ts for a small build-memory win. Effort M.

**Severity: LOW/MEDIUM** (robustness) — Astro 7.1 adoption, pre-onboarding audit (2026-07-19). Repo is already on astro 7.1.1, so this is adoption, not a version bump (no migration risk). Astro 7.1 adds finer-grained CSP directives (`script-src-elem`, `script-src-attr`, `style-src-elem`, `style-src-attr`). Today `src/lib/cap-widget-csp.ts:18-45` string-scrapes the minified Cap widget source to hash its shadow-root inline `<style>` — brittle and fail-closed on any upstream restyle (captcha loses styling). The new directives let us allow inline styles precisely without weakening `script-src`, so the fragile hash extraction can be dropped. ### Ask Add the finer-grained directives under `security.csp.directives` in `astro.config.mjs`; remove/simplify `cap-widget-csp.ts`; verify with `build` + `preview` (CSP is off in dev). Optionally add `deferRender` to the `glob` content loaders in `src/content.config.ts` for a small build-memory win. Effort M.

supernaut lade till etiketterna

area/web

ready-for-implementation

type

task

2026-07-19 06:59:50 +00:00

supernaut lade till detta till projektet Bitborg Web

2026-07-19 07:04:50 +00:00

supernaut refererade till detta ärende från en incheckning

2026-07-20 15:12:21 +00:00

feat(csp): de-brittle captcha style CSP via style-src-elem nonce

supernaut hänvisade till detta ärende från en ändringsförfrågan som kommer att stänga det