Skip to content

🔒 Add Content Security Policy (CSP)#14

Open
Randomblock1 wants to merge 1 commit intomainfrom
fix-csp-vulnerability-16193929424739068197
Open

🔒 Add Content Security Policy (CSP)#14
Randomblock1 wants to merge 1 commit intomainfrom
fix-csp-vulnerability-16193929424739068197

Conversation

@Randomblock1
Copy link
Owner

@Randomblock1 Randomblock1 commented Feb 25, 2026

🎯 What: Implemented a strict Content Security Policy (CSP) in svelte.config.js to mitigate Cross-Site Scripting (XSS) and other injection attacks.
⚠️ Risk: Without CSP, the application was vulnerable to XSS if an attacker could inject malicious scripts. The risk was elevated due to the use of sensitive PDF processing features.
🛡️ Solution:

  1. Configured kit.csp with mode: 'hash' for adapter-static.
  2. Defined directives to allow only necessary resources:
    • script-src: Self, specific external domains (Google Analytics, Microsoft), and wasm-unsafe-eval (required for qpdf-wasm).
    • style-src: Self and unsafe-inline (required for Svelte transitions and Microsoft badge widget).
    • img-src, connect-src, frame-src: Whitelisted necessary domains.
    • object-src: 'none' and base-uri: 'self'.
  3. Fixed src/app.html structure by moving %sveltekit.head% into <head> to ensure CSP meta tags are injected correctly.
  4. Refactored inline Google Analytics script in src/lib/Analytics.svelte to an external file static/gtag.js to simplify CSP management.

PR created automatically by Jules for task 16193929424739068197 started by @Randomblock1

@google-labs-jules @Randomblock1
Add Content Security Policy (CSP)
f5de817 
- Configure `kit.csp` in `svelte.config.js` with `mode: 'hash'`.
- Define strict directives for scripts, styles, images, connections, and frames.
- Move `%sveltekit.head%` to `<head>` in `src/app.html`.
- Move inline analytics script to `static/gtag.js`.
- Clean up unused imports in `src/routes/privacy/+page.svelte`.

Co-authored-by: Randomblock1 <19873803+Randomblock1@users.noreply.github.com>
@google-labs-jules
Copy link
Contributor

google-labs-jules bot commented Feb 25, 2026

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@Randomblock1