mirror of
https://github.com/0x5477/phantomlink.git
synced 2026-11-06 00:14:39 +00:00
pevnitskyparitshith184
f456aca92c
- X25519 session key exchange (Ed25519-signed, TOFU for new devices); messages, voice, file chunks now AES-256-GCM encrypted on the wire - Fix get_messages deadlock with file/image/voice messages - Fix upsert_device wiping ip/port/avatar; upsert_conversation preserves unread/pinned/muted - Fix route scan replies (Hello alias registration) and cap scan at 4096 hosts - File transfer: size caps, SHA-256 verification on receive - Auto-backup with master-key-derived backup key + rotation; backups now include attachments; import falls back to internal backup key - Lock on system sleep / window blur; clipboard clear honors configured delay - CSP: allow media-src for voice playback; async long-running commands; configurable listen port
29 lines
841 B
JavaScript
Executable File
29 lines
841 B
JavaScript
Executable File
import { readFileSync, writeFileSync } from "node:fs";
|
|
|
|
const CSP = [
|
|
"default-src 'self'",
|
|
"script-src 'self'",
|
|
"style-src 'self' 'unsafe-inline'",
|
|
"img-src 'self' data: blob:",
|
|
// data:/blob: needed for in-app playback of voice messages
|
|
"media-src 'self' data: blob:",
|
|
"connect-src ipc: http://ipc.localhost",
|
|
"font-src 'self' data:",
|
|
"object-src 'none'",
|
|
"base-uri 'none'",
|
|
"form-action 'none'",
|
|
].join("; ");
|
|
|
|
const file = "dist/index.html";
|
|
const html = readFileSync(file, "utf8");
|
|
if (!html.includes("Content-Security-Policy")) {
|
|
const injected = html.replace(
|
|
"<head>",
|
|
`<head>\n <meta http-equiv="Content-Security-Policy" content="${CSP}" />`,
|
|
);
|
|
writeFileSync(file, injected);
|
|
console.log("[inject-csp] CSP injected");
|
|
} else {
|
|
console.log("[inject-csp] CSP already present, skipping");
|
|
}
|