From 717e694370553a1a5e67c7617b62e292ffd2f4e1 Mon Sep 17 00:00:00 2001
From: H-Chris233 <h-chris233@outlook.com>
Date: Fri, 8 May 2026 12:00:09 +0800
Subject: [PATCH] Constrain WebView loading with a minimal CSP

The desktop WebView no longer runs with an unexplained disabled CSP. The policy keeps scripts self-hosted, permits Tauri IPC and local Vite development connections, keeps provider/update/model networking on the Rust side, and documents the only unsafe allowance for React inline styles used by the existing pixel-aligned UI.

Constraint: Issue #226 requires csp:null to be replaced or explicitly bounded

Constraint: Provider validation, updater checks, and model downloads are Rust-side paths, not frontend fetch allowlist entries

Rejected: Keep csp:null with documentation only | weaker defense-in-depth and leaves the WebView effectively unconstrained

Confidence: high

Scope-risk: narrow

Directive: Do not add external provider domains to WebView connect-src unless a frontend fetch path is introduced

Tested: npm run build

Tested: npm run tauri -- info

Tested: cargo check --manifest-path src-tauri/Cargo.toml
---
 docs/tauri-csp.md                          | 10 ++++++++++
 openless-all/app/src-tauri/tauri.conf.json | 13 ++++++++++++-
 2 files changed, 22 insertions(+), 1 deletion(-)
 create mode 100644 docs/tauri-csp.md

diff --git a/docs/tauri-csp.md b/docs/tauri-csp.md
new file mode 100644
index 00000000..2ec05077
--- /dev/null
+++ b/docs/tauri-csp.md
@@ -0,0 +1,10 @@
+# Tauri CSP 边界
+
+OpenLess 的桌面 WebView 已在 `openless-all/app/src-tauri/tauri.conf.json` 启用最小 CSP。该策略只放开前端渲染和 Tauri IPC 必需的来源：
+
+- `script-src 'self'`：脚本只允许随应用打包的前端产物；Tauri 会在构建时为自身注入脚本补齐必要 nonce / hash。
+- `connect-src 'self' ipc: http://ipc.localhost http://localhost:1420 ws://localhost:1420`：允许同源连接、Tauri IPC，以及 Vite 开发模式的本机 HTTP / HMR 连接。
+- `style-src 'self' 'unsafe-inline' https://fonts.googleapis.com` 与 `font-src https://fonts.gstatic.com`：当前 React 页面大量使用 `style={{ ... }}` 保持设计稿像素对齐，因此短期保留 inline style；外部字体只允许 Google Fonts 相关域名。
+- `object-src 'none'`、`base-uri 'none'`、`form-action 'none'`、`frame-ancestors 'none'`：关闭插件对象、base URL、表单提交和嵌入入口。
+
+Provider 校验、ASR/LLM 请求、更新检查、本地 ASR 模型下载等网络访问都在 Rust / Tauri plugin 侧执行，不通过 WebView 的 `fetch` 直连外部服务，因此不在 WebView CSP 中放开 provider 域名。QA markdown 的 sanitizer 仍是第一道防线；CSP 只作为纵深防御。
diff --git a/openless-all/app/src-tauri/tauri.conf.json b/openless-all/app/src-tauri/tauri.conf.json
index 5961aca8..3446cf9a 100644
--- a/openless-all/app/src-tauri/tauri.conf.json
+++ b/openless-all/app/src-tauri/tauri.conf.json
@@ -66,7 +66,18 @@
       }
     ],
     "security": {
-      "csp": null
+      "csp": {
+        "default-src": "'self' customprotocol: asset:",
+        "script-src": "'self'",
+        "style-src": "'self' 'unsafe-inline' https://fonts.googleapis.com",
+        "font-src": "'self' https://fonts.gstatic.com",
+        "img-src": "'self' asset: http://asset.localhost blob: data:",
+        "connect-src": "'self' ipc: http://ipc.localhost http://localhost:1420 ws://localhost:1420",
+        "object-src": "'none'",
+        "base-uri": "'none'",
+        "form-action": "'none'",
+        "frame-ancestors": "'none'"
+      }
     }
   },
   "bundle": {