openvibers/openvibe.network Commits

Home CSP: let the Community screenshot pastes through (#578)

OP OpenVibers committed 7 days ago · 081f7a99da · 2 files, +26 −1

The home page's "Right now" shows public screenshot pastes from openvibe.community, but img-src allowed only
openvibe.media and openvibe.live, so the browser refused the picture and the card showed nothing (found by a production
check of the Share sheet, 2026-11-06). A test reads the served img-src for all three.

Changes

ddiff --git a/server/index.js b/server/index.js
iindex 8e789005..03ae0a17 100644
---- a/server/index.js
++++ b/server/index.js
@@@ -123,7 +123,9 @@ app.use(helmet({
              scriptSrc: ["'self'", "'unsafe-inline'", "https://openvibe.network", "https://openvibe.live", "cdn.jsdelivr.net", "fonts.googleapis.com", "https://static.cloudflareinsights.com"],
              styleSrc: ["'self'", "'unsafe-inline'", "fonts.googleapis.com", "fonts.gstatic.com"],
              fontSrc: ["'self'", "fonts.gstatic.com"],
--            imgSrc: ["'self'", "data:", "blob:", "https://openvibe.media", "https://openvibe.live"],   // avatars and media live on openvibe.media; live-stream thumbnails on the home page come from openvibe.live
++            // Avatars and media live on openvibe.media; the home page's live-stream thumbnails come from openvibe.live and
++            // its "Right now" screenshot pastes from openvibe.community (blocked until 2026-11-06: the card showed nothing).
++            imgSrc: ["'self'", "data:", "blob:", "https://openvibe.media", "https://openvibe.live", "https://openvibe.community"],
              connectSrc: [
                  "'self'",
                  "https://openvibe.network",
ddiff --git a/test/home-image-csp.test.js b/test/home-image-csp.test.js
nnew file mode 100644
iindex 00000000..d415ddad
---- /dev/null
++++ b/test/home-image-csp.test.js
@@@ -0,0 +1,23 @@
++'use strict';
++// The home page's pictures come from three places, and the CSP must let each one through: avatars and media from
++// openvibe.media, live thumbnails from openvibe.live, and the "Right now" screenshot pastes from openvibe.community
++// (blocked until 2026-11-06: a screenshot card showed nothing, and the browser logged a CSP refusal).
++const assert = require('assert');
++const { bootServer } = require('./helpers/boot-server');
++
++(async () => {
++    const srv = await bootServer();
++    try {
++        const r = await fetch(srv.base + '/');
++        const csp = r.headers.get('content-security-policy') || '';
++        const img = (csp.split(';').map((d) => d.trim()).find((d) => d.startsWith('img-src')) || '').split(/\s+/);
++        for (const origin of ['https://openvibe.media', 'https://openvibe.live', 'https://openvibe.community']) {
++            assert.ok(img.includes(origin), `img-src lets ${origin} through: ${img.join(' ')}`);
++        }
++        console.log('home image CSP: media, live and community pictures allowed');
++        await srv.stop();
++        process.exit(0);
++    } finally {
++        await srv.stop();
++    }
++})().catch((e) => { console.error(e); process.exit(1); });