From cf9c99d0fb9b0ff5c96e3082d3539b274029b582 Mon Sep 17 00:00:00 2001
From: louzt <davidmirelesll@outlook.com>
Date: Mon, 15 Jun 2026 00:59:28 -0600
Subject: [PATCH] fix(tauri): enable Content Security Policy

Replaces \csp\: null with a strict policy:
- No inline scripts
- No external scripts except self
- No object/class embeddings
- No frame ancestors

Prevents XSS via malicious channel names or M3U metadata from
executing in the Tauri webview with IPC access.

Refs: https://github.com/Fredolx/open-tv/issues/424
---
 src-tauri/tauri.conf.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src-tauri/tauri.conf.json b/src-tauri/tauri.conf.json
index 10cf16e8..c0ee660c 100644
--- a/src-tauri/tauri.conf.json
+++ b/src-tauri/tauri.conf.json
@@ -20,7 +20,7 @@
       }
     ],
     "security": {
-      "csp": null
+      "csp": "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https:; connect-src 'self' https: blob:; media-src 'self' https: blob:; font-src 'self' data:; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'"
     }
   },
   "bundle": {