From 03c4b5376db6bd4edb32bff7593f432276d0f345 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=E9=9B=B7=E7=94=B5=E8=8A=BD=E8=A1=A3?=
 <zhangyanghaha0407@outlook.com>
Date: Fri, 26 Jun 2026 18:05:58 -0400
Subject: [PATCH] Harden the renderer CSP (sec #2)

The policy fell back to default-src for scripts and allowed
'unsafe-inline', so any future injection sink would run with the
renderer's full contextBridge authority. The page has no inline scripts
(one external module), so split the directives: script-src 'self' with
no inline, style-src keeps 'unsafe-inline' for React inline styles, and
add object-src/base-uri/frame-src 'none'. localhost stays only on
script/connect for the dev server. Verified the production build still
loads and renders end to end.
---
 AgentCompany-New/src/renderer/index.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/AgentCompany-New/src/renderer/index.html b/AgentCompany-New/src/renderer/index.html
index 89017642..e6056b45 100644
--- a/AgentCompany-New/src/renderer/index.html
+++ b/AgentCompany-New/src/renderer/index.html
@@ -4,7 +4,7 @@
     <meta charset="UTF-8" />
     <meta
       http-equiv="Content-Security-Policy"
-      content="default-src 'self' 'unsafe-inline' http://localhost:* ws://localhost:* data:; img-src 'self' data:; font-src 'self' data:;"
+      content="default-src 'self'; script-src 'self' http://localhost:*; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self' data:; connect-src 'self' http://localhost:* ws://localhost:*; object-src 'none'; base-uri 'none'; frame-src 'none';"
     />
     <meta name="viewport" content="width=device-width, initial-scale=1.0" />
     <title>AgentCompany</title>