git-watchtower 2.3.12 → 2.3.13

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "git-watchtower",
-  "version": "2.3.12",
+  "version": "2.3.13",
   "description": "Terminal-based Git branch monitor with activity sparklines and optional dev server with live reload",
   "main": "bin/git-watchtower.js",
   "bin": {

package/src/casino/index.js

@@ -110,6 +110,13 @@ function disable() {
   // up to ~15 frames × 120 ms = 1.8 s after disable, and lossMessage stayed
   // set so isLossAnimating() reported true into the next session.
   resetLossState();
+  // Drop the marquee render callback so a stale closure to the previous
+  // session's render() doesn't survive across enable/disable cycles. In
+  // production this is mostly hygiene (bin/git-watchtower.js wires the
+  // callback exactly once at startup against a singleton render fn), but
+  // tests that re-use the casino module saw the previous test's callback
+  // persist into the next setRenderCallback assignment.
+  marqueeCallback = null;
 }
 
 /**

package/src/server/web.js

@@ -46,6 +46,36 @@ const SSE_KEEPALIVE_INTERVAL = 15000;
  */
 const MAX_STALLED_PUSHES = 60;
 
+/**
+ * Content-Security-Policy header for the dashboard HTML.
+ *
+ * The dashboard uses inline <script> and inline <style> blocks (the whole
+ * UI is bundled at build time), and makes XHR / EventSource calls to
+ * /api/... on the same origin. No external resources are loaded.
+ *
+ * `default-src 'none'` denies everything not explicitly allowed.
+ * `script-src` / `style-src` need 'unsafe-inline' for the bundled blocks.
+ * `connect-src 'self'` lets XHR + SSE hit /api/... .
+ * `base-uri 'none'` blocks <base> injection from rewriting URLs.
+ * `form-action 'none'` blocks any rogue form posts.
+ * `frame-ancestors 'none'` blocks embedding (defense vs. clickjacking).
+ *
+ * Defense-in-depth — the dashboard already escapes user-supplied content
+ * everywhere we render it, but a future regression that forgets escHtml
+ * is mitigated here.
+ */
+const CONTENT_SECURITY_POLICY = [
+  "default-src 'none'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "connect-src 'self'",
+  "img-src 'self' data:",
+  "font-src 'self'",
+  "base-uri 'none'",
+  "form-action 'none'",
+  "frame-ancestors 'none'",
+].join('; ');
+
 /**
  * Actions the web dashboard is allowed to POST to /api/action. Every entry
  * here MUST be matched by a `case` in `handleWebAction` in bin/git-watchtower.js
@@ -474,7 +504,12 @@ class WebDashboardServer {
 
     // Routes
     if (pathname === '/' && req.method === 'GET') {
-      res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+      res.writeHead(200, {
+        'Content-Type': 'text/html; charset=utf-8',
+        'Content-Security-Policy': CONTENT_SECURITY_POLICY,
+        'X-Content-Type-Options': 'nosniff',
+        'Referrer-Policy': 'no-referrer',
+      });
       res.end(this._cachedHtml);
       return;
     }
@@ -673,4 +708,5 @@ module.exports = {
   STATE_PUSH_INTERVAL,
   MAX_STALLED_PUSHES,
   ALLOWED_ACTIONS,
+  CONTENT_SECURITY_POLICY,
 };