fix: harden VS Code bridge and webview CSP

2026-06-24 09:45:36 +01:00
parent 07c31b5d1e
commit 3a16a14d6e
5 changed files with 129 additions and 15 deletions
@@ -219,6 +219,21 @@ assertContains(
  "VNC Connections",
  "in-app help must document VNC connection profiles",
 );
+assertContains(
+  "vscode/nexus/extension.js",
+  "crypto.randomBytes(16).toString('base64')",
+  "Nexus VS Code webview CSP nonces must use cryptographic randomness",
+);
+assertContains(
+  "vscode/leviathan/extension.js",
+  "crypto.randomBytes(16).toString('base64')",
+  "Leviathan VS Code webview CSP nonces must use cryptographic randomness",
+);
+assertTreeNotContains(
+  "vscode",
+  "const nonce = String(Date.now());",
+  "VS Code webview CSP nonces must not be predictable timestamps",
+);
 assertContains(
  "docs/user-manual.md",
  "## 11. Leviathan binary workbench",