Red-team XSS/rendering finding (public-share renders our HTML in Chromium):
- Both letterhead templates get a strict CSP meta (default-src none; img-src
data:; style-src unsafe-inline; base-uri/form-action none) — permits the
inline CSS + data: logo the templates actually use, blocks all script
execution and every outbound/file fetch. Identical in preview + PDF, so the
byte-for-byte preview-fidelity golden test still passes.
- renderPdf aborts every non-data: network request at the browser layer.
Together an esc() miss becomes a harmless rendering glitch instead of an
SSRF/exfiltration/RCE-adjacent vector. Template + fidelity tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Two small improvements that were uncommitted in the working tree:
- .env.example: document HQ_OWNER_EMAIL; refresh the Postgres section (D19 delivered)
- pdf.ts: launch Chromium with --no-sandbox --disable-dev-shm-usage so it runs in a
container; inert on a dev machine, and we only ever render our own self-contained HTML
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Thomas Joise