CyberCoveLLC/Triple-C
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 128 Wiki Activity

Fix security: enable CSP and eliminate shell injection in entrypoint

Browse Source 
- Enable restrictive Content Security Policy in tauri.conf.json instead
  of null (disabled), restricting scripts/connects to self + Tauri IPC
- Fix shell injection in entrypoint.sh by replacing su -c with direct
  git config --file writes, preventing names with quotes (e.g. O'Brien)
  from breaking startup or enabling code execution

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Josh Knapp
2026-02-28 20:43:04 +00:00
parent 03e0590631
commit 265b365f0b
2 changed files with 5 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
app/src-tauri/tauri.conf.json
View File

@@ -22,7 +22,7 @@
} }
], ],
"security": { "security": {
"csp": null "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' asset: https://asset.localhost; font-src 'self' data:; connect-src 'self' ipc: http://ipc.localhost"
} }
}, },
"bundle": { "bundle": {

7
container/entrypoint.sh
View File

@@ -82,17 +82,18 @@ if [ -n "$GIT_TOKEN" ]; then
echo "https://oauth2:${GIT_TOKEN}@github.com" >> "$CRED_FILE" echo "https://oauth2:${GIT_TOKEN}@github.com" >> "$CRED_FILE"
echo "https://oauth2:${GIT_TOKEN}@gitlab.com" >> "$CRED_FILE" echo "https://oauth2:${GIT_TOKEN}@gitlab.com" >> "$CRED_FILE"
echo "https://oauth2:${GIT_TOKEN}@bitbucket.org" >> "$CRED_FILE" echo "https://oauth2:${GIT_TOKEN}@bitbucket.org" >> "$CRED_FILE"
su -s /bin/bash claude -c "git config --global credential.helper 'store --file=$CRED_FILE'" git config --global --file /home/claude/.gitconfig credential.helper "store --file=$CRED_FILE"
unset GIT_TOKEN unset GIT_TOKEN
fi fi
# ── Git user config ────────────────────────────────────────────────────────── # ── Git user config ──────────────────────────────────────────────────────────
if [ -n "$GIT_USER_NAME" ]; then if [ -n "$GIT_USER_NAME" ]; then
su -s /bin/bash claude -c "git config --global user.name '$GIT_USER_NAME'" git config --global --file /home/claude/.gitconfig user.name "$GIT_USER_NAME"
fi fi
if [ -n "$GIT_USER_EMAIL" ]; then if [ -n "$GIT_USER_EMAIL" ]; then
su -s /bin/bash claude -c "git config --global user.email '$GIT_USER_EMAIL'" git config --global --file /home/claude/.gitconfig user.email "$GIT_USER_EMAIL"
fi fi
chown claude:claude /home/claude/.gitconfig 2>/dev/null || true
# ── Claude instructions ────────────────────────────────────────────────────── # ── Claude instructions ──────────────────────────────────────────────────────
if [ -n "$CLAUDE_INSTRUCTIONS" ]; then if [ -n "$CLAUDE_INSTRUCTIONS" ]; then