thePR0M3TH3AN/bitvid
1
0 Fork 0
mirror of https://github.com/PR0M3TH3AN/bitvid.git synced 2026-11-05 04:12:25 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(csp,smoke): allow ws://localhost relays; fix smoke publish await

Browse Source 
Two pre-existing issues surfaced by running the smoke test:

1. CSP connect-src allowed `wss:` but not `ws:`, so ALL insecure-websocket
   relays were blocked — including ws://localhost (dev + local relays + the
   smoke mock relay). Add `ws://localhost:* ws://127.0.0.1:*` to connect-src in
   index.html and embed.html. Remote cleartext ws:// stays blocked (deliberate
   security posture — flagged for product decision).

2. smoke-test.mjs published via Promise.any(relays.map(url => pool.publish([url],
   evt))). SimplePool.publish returns an ARRAY of per-relay promises, so this
   Promise.any'd arrays-of-arrays — resolving on the array object immediately
   without awaiting the publish and swallowing errors. Fixed to await
   pool.publish(relays, evt) via Promise.allSettled and surface per-relay
   results.

Smoke test now passes (publish -> relay verify). CSP policy test green; build green.

Co-Authored-By: Claude Opus 4.8 <[email protected]>
This commit is contained in:
thePR0M3TH3ANandClaude Opus 4.8 committed 2026-06-19 22:24:58 -04:00
1 parent 126ac75a25
commit b844b71f55
3 files changed
+22 -28
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

embed.html
+1 -1
View File
@@ -11,7 +11,7 @@
-->
<meta
http-equiv="Content-Security-Policy"
content="default-src 'self'; script-src 'self' 'sha256-dnv/l3q8gLqdw0etekr5/atoIRbM/wSVSgQjZEsC7G0=' https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline'; img-src 'self' https: data: blob:; media-src 'self' https: blob: mediastream:; connect-src 'self' https: wss: blob: data:; worker-src 'self' blob:; font-src 'self' data:; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; manifest-src 'self'"
content="default-src 'self'; script-src 'self' 'sha256-dnv/l3q8gLqdw0etekr5/atoIRbM/wSVSgQjZEsC7G0=' https://cdn.jsdelivr.net https://esm.sh; style-src 'self' 'unsafe-inline'; img-src 'self' https: data: blob:; media-src 'self' https: blob: mediastream:; connect-src 'self' https: wss: ws://localhost:* ws://127.0.0.1:* blob: data:; worker-src 'self' blob:; font-src 'self' data:; frame-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; manifest-src 'self'"
/>
<meta name="viewport" content="width=device-width, initial-scale=1.0" />
<title>bitvid | Embed</title>