From c493ce1d8e47f4b5fa5f1a3cec0e1e31018c0cc7 Mon Sep 17 00:00:00 2001
From: Jean Ribeiro <contact@jeanribeiro.dev>
Date: Thu, 16 May 2024 17:27:07 -0300
Subject: [PATCH 1/2] feat: adds restrictive content security policies

---
 packages/desktop/public/about.html | 22 ++++++++++++++++++++++
 packages/desktop/public/error.html | 21 +++++++++++++++++++++
 packages/desktop/public/index.html | 21 +++++++++++++++------
 3 files changed, 58 insertions(+), 6 deletions(-)

diff --git a/packages/desktop/public/about.html b/packages/desktop/public/about.html
index 8a9fa0475f..6bb9072408 100644
--- a/packages/desktop/public/about.html
+++ b/packages/desktop/public/about.html
@@ -6,6 +6,28 @@
       name="viewport"
       content="width=device-width, initial-scale=1, user-scalable=no"
     />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="
+          default-src 'self';
+          connect-src 'self';
+          img-src 'self';
+          base-uri 'self';
+          form-action 'none';
+          frame-src 'none';
+          worker-src 'none';
+          script-src-elem 'self' 'unsafe-inline';
+          script-src-attr 'none';
+          style-src-elem 'self' 'unsafe-inline';
+          style-src-attr 'none';
+          object-src 'none';
+          media-src 'self';
+          font-src 'self';
+          manifest-src 'self';
+          navigate-to 'self';
+          upgrade-insecure-requests;
+      "
+    />
     <title></title>
     <style>
       @font-face {
diff --git a/packages/desktop/public/error.html b/packages/desktop/public/error.html
index 323c4f4cf8..63f2b44688 100644
--- a/packages/desktop/public/error.html
+++ b/packages/desktop/public/error.html
@@ -5,6 +5,27 @@
     <meta charset="utf-8"/>
     <meta name="viewport"
           content="width=device-width, initial-scale=1, user-scalable=no"/>
+    <meta
+        http-equiv="Content-Security-Policy"
+        content="
+            default-src 'self';
+            connect-src 'self';
+            img-src 'self';
+            base-uri 'self';
+            form-action 'none';
+            frame-src 'none';
+            worker-src 'none';
+            script-src 'self' 'unsafe-inline';
+            style-src-elem 'self' 'unsafe-inline';
+            style-src-attr 'none';
+            object-src 'none';
+            media-src 'self';
+            font-src 'self';
+            manifest-src 'self';
+            navigate-to 'self';
+            upgrade-insecure-requests;
+        "
+    />
     <title>Bloom Error</title>
     <style>
         @font-face {
diff --git a/packages/desktop/public/index.html b/packages/desktop/public/index.html
index 7ceaedfe14..bd31dd853c 100644
--- a/packages/desktop/public/index.html
+++ b/packages/desktop/public/index.html
@@ -7,13 +7,22 @@
             http-equiv="Content-Security-Policy"
             content="
                 default-src 'self';
-                connect-src 'self' https://* wss://*;
-                frame-src 'self' https://*;
+                connect-src 'self' https://* wss://relay.walletconnect.com;
+                img-src 'self' https://tideprotocol.infura-ipfs.io data:;
+                base-uri 'self';
+                form-action 'self';
+                frame-src 'self' https://verify.walletconnect.org https://verify.walletconnect.com;
+                worker-src 'self';
+                script-src-elem 'self' 'unsafe-inline';
+                script-src-attr 'none';
+                style-src-elem 'self' 'unsafe-inline';
+                style-src-attr 'self' 'unsafe-inline';
                 object-src 'none';
-                img-src 'self' https: data:;
-                style-src 'self' 'unsafe-inline';
-                media-src 'self' data:;
-                script-src 'self';
+                media-src 'self';
+                font-src 'self';
+                manifest-src 'self';
+                navigate-to 'self';
+                upgrade-insecure-requests;
             "
         />
 

From 71bf08ae40f8df3909d9b2844078fc4bb41c21c8 Mon Sep 17 00:00:00 2001
From: Jean Ribeiro <contact@jeanribeiro.dev>
Date: Wed, 22 May 2024 14:48:24 -0300
Subject: [PATCH 2/2] fix: removes unsafe-inline from error and about CSP
 policies

---
 packages/desktop/public/about.css  |  41 ++++
 packages/desktop/public/about.html |  62 +-----
 packages/desktop/public/about.js   |   9 +
 packages/desktop/public/error.css  | 111 +++++++++++
 packages/desktop/public/error.html | 292 ++++++-----------------------
 packages/desktop/public/error.js   |  65 +++++++
 6 files changed, 285 insertions(+), 295 deletions(-)
 create mode 100644 packages/desktop/public/about.css
 create mode 100644 packages/desktop/public/about.js
 create mode 100644 packages/desktop/public/error.css
 create mode 100644 packages/desktop/public/error.js

diff --git a/packages/desktop/public/about.css b/packages/desktop/public/about.css
new file mode 100644
index 0000000000..29b4b89f09
--- /dev/null
+++ b/packages/desktop/public/about.css
@@ -0,0 +1,41 @@
+@font-face {
+    font-family: 'Silka';
+    font-style: normal;
+    font-weight: 500;
+    font-display: swap;
+    src: url('./assets/fonts/silka/silka-medium-webfont.woff2') format('woff2');
+}
+
+body,
+html {
+    width: 100%;
+    height: 100%;
+    user-select: none;
+    -webkit-user-drag: none;
+    overflow: hidden;
+}
+
+body {
+    margin: 0;
+    display: flex;
+    flex-direction: column;
+    justify-content: center;
+    align-items: center;
+    color: #ffffff;
+    background-color: #161926;
+    font-size: 11px;
+    font-family: 'Silka';
+}
+
+#app-icon {
+    margin-top: 20px;
+    -webkit-user-drag: none;
+}
+
+#app-version {
+    margin-bottom: 0.05rem;
+}
+
+#footer {
+    margin-bottom: 30px;
+}
diff --git a/packages/desktop/public/about.html b/packages/desktop/public/about.html
index 6bb9072408..b2eef3ab3f 100644
--- a/packages/desktop/public/about.html
+++ b/packages/desktop/public/about.html
@@ -16,9 +16,9 @@
           form-action 'none';
           frame-src 'none';
           worker-src 'none';
-          script-src-elem 'self' 'unsafe-inline';
+          script-src-elem 'self';
           script-src-attr 'none';
-          style-src-elem 'self' 'unsafe-inline';
+          style-src-elem 'self';
           style-src-attr 'none';
           object-src 'none';
           media-src 'self';
@@ -29,67 +29,13 @@
       "
     />
     <title></title>
-    <style>
-      @font-face {
-        font-family: 'Silka';
-        font-style: normal;
-        font-weight: 500;
-        font-display: swap;
-        src: url('./assets/fonts/silka/silka-medium-webfont.woff2') format('woff2');
-      }
-
-      body,
-
-      html {
-        width: 100%;
-        height: 100%;
-        user-select: none;
-        -webkit-user-drag: none;
-        overflow: hidden;
-      }
-
-      body {
-        margin: 0;
-        display: flex;
-        flex-direction: column;
-        justify-content: center;
-        align-items: center;
-        color: #ffffff;
-        background-color: #161926;
-        font-size: 11px;
-        font-family: 'Silka';
-      }
-
-      #app-icon {
-        margin-top: 20px;
-        -webkit-user-drag: none;
-      }
-
-      #app-version {
-        margin-bottom: 0.05rem;
-      }
-
-      #footer {
-        margin-bottom: 30px;
-      }
-    </style>
+    <link rel="stylesheet" href="about.css">
   </head>
   <body>
     <img id="app-icon" alt="App icon" height="70" width="70" />
     <h2 id="title"></h2>
     <p id="app-version"></p>
-
     <p id="footer"></p>
-    <!-- https://github.com/electron/electron/issues/2863 -->
-    <script>var exports = exports || {};</script>
-
-    <script>
-        window.about.getData().then((aboutData) => {
-          document.getElementById('title').textContent = aboutData.appName
-          document.getElementById('app-icon').src = aboutData.iconPath
-          document.getElementById('app-version').textContent = aboutData.version
-          document.getElementById('footer').textContent = `Bloom Labs Ltd. ${new Date().getFullYear()}`
-        })
-    </script>
+    <script src="about.js"></script>
   </body>
 </html>
diff --git a/packages/desktop/public/about.js b/packages/desktop/public/about.js
new file mode 100644
index 0000000000..206d65eaa9
--- /dev/null
+++ b/packages/desktop/public/about.js
@@ -0,0 +1,9 @@
+// https://github.com/electron/electron/issues/2863
+var exports = exports || {}
+
+window.about.getData().then((aboutData) => {
+    document.getElementById('title').textContent = aboutData.appName
+    document.getElementById('app-icon').src = aboutData.iconPath
+    document.getElementById('app-version').textContent = aboutData.version
+    document.getElementById('footer').textContent = `Bloom Labs Ltd. ${new Date().getFullYear()}`
+})
diff --git a/packages/desktop/public/error.css b/packages/desktop/public/error.css
new file mode 100644
index 0000000000..faf6c30129
--- /dev/null
+++ b/packages/desktop/public/error.css
@@ -0,0 +1,111 @@
+@font-face {
+    font-family: 'Silka';
+    font-style: normal;
+    font-weight: 500;
+    font-display: swap;
+    src: url('./assets/fonts/silka/silka-medium-webfont.woff2') format('woff2');
+}
+
+* {
+    margin: 0;
+    padding: 0;
+    box-sizing: border-box;
+}
+
+body,
+html {
+    width: 100%;
+    height: 100%;
+    user-select: none;
+    -webkit-user-drag: none;
+    overflow: hidden;
+}
+
+body {
+    display: flex;
+    justify-content: stretch;
+    color: #ffffff;
+    background-color: #161926;
+    font-size: 11px;
+    font-family: 'Silka';
+}
+
+a {
+    color: #b196ef;
+}
+
+hr {
+    width: 100%;
+    border: 0;
+    border-top: 1px solid #212537;
+    margin: 1.5rem 0;
+}
+
+button {
+    display: flex;
+    flex-direction: row;
+    align-items: center;
+    justify-content: center;
+    border: 0px solid rgb(150, 108, 230);
+    box-sizing: border-box;
+    cursor: pointer;
+    border-radius: 3rem;
+    padding-left: 1.5rem;
+    padding-right: 1.5rem;
+    padding-top: 0.5rem;
+    padding-bottom: 0.5rem;
+    height: 3rem;
+    background-color: rgb(150, 108, 230);
+    width: fit-content;
+    color: white;
+    font-family: Silka;
+    font-size: 16px;
+}
+
+.content {
+    flex: 1;
+    display: flex;
+    margin: 2rem;
+    display: flex;
+    flex-direction: column;
+}
+
+#app-icon {
+    -webkit-user-drag: none;
+    margin: 1rem 0;
+}
+
+#title {
+    margin: 1rem 0;
+}
+
+#diagnostics {
+    margin: 1rem 0;
+}
+
+#details {
+    margin: 1rem 0;
+    flex: 1;
+    overflow-y: auto;
+    white-space: pre-line;
+    min-height: 50px;
+}
+
+.help {
+    color: #c4d1e8;
+    font-size: 0.8rem;
+    line-height: 1.5rem;
+}
+
+::-webkit-scrollbar {
+    width: 8px;
+}
+
+::-webkit-scrollbar-thumb {
+    background-color: #d8e3f5;
+    border-radius: 10px;
+}
+
+::-webkit-scrollbar-track {
+    background-color: transparent;
+}
diff --git a/packages/desktop/public/error.html b/packages/desktop/public/error.html
index 63f2b44688..7b67e51363 100644
--- a/packages/desktop/public/error.html
+++ b/packages/desktop/public/error.html
@@ -1,240 +1,58 @@
 <!DOCTYPE html>
 <html>
-
-<head>
-    <meta charset="utf-8"/>
-    <meta name="viewport"
-          content="width=device-width, initial-scale=1, user-scalable=no"/>
-    <meta
-        http-equiv="Content-Security-Policy"
-        content="
-            default-src 'self';
-            connect-src 'self';
-            img-src 'self';
-            base-uri 'self';
-            form-action 'none';
-            frame-src 'none';
-            worker-src 'none';
-            script-src 'self' 'unsafe-inline';
-            style-src-elem 'self' 'unsafe-inline';
-            style-src-attr 'none';
-            object-src 'none';
-            media-src 'self';
-            font-src 'self';
-            manifest-src 'self';
-            navigate-to 'self';
-            upgrade-insecure-requests;
-        "
-    />
-    <title>Bloom Error</title>
-    <style>
-        @font-face {
-            font-family: 'Silka';
-            font-style: normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url('./assets/fonts/silka/silka-medium-webfont.woff2') format('woff2');
-        }
-
-        * {
-            margin: 0;
-            padding: 0;
-            box-sizing: border-box;
-        }
-
-        body,
-        html {
-            width: 100%;
-            height: 100%;
-            user-select: none;
-            -webkit-user-drag: none;
-            overflow: hidden;
-        }
-
-        body {
-            display: flex;
-            justify-content: stretch;
-            color: #ffffff;
-            background-color: #161926;
-            font-size: 11px;
-            font-family: 'Silka';
-        }
-
-        a {
-            color: #b196ef;
-        }
-
-        hr {
-            width: 100%;
-            border: 0;
-            border-top: 1px solid #212537;
-            margin: 1.5rem 0;
-        }
-
-        button {
-            display: flex;
-            flex-direction: row;
-            align-items: center;
-            justify-content: center;
-            border: 0px solid rgb(150, 108, 230);
-            box-sizing: border-box;
-            cursor: pointer;
-            border-radius: 3rem;
-            padding-left: 1.5rem;
-            padding-right: 1.5rem;
-            padding-top: 0.5rem;
-            padding-bottom: 0.5rem;
-            height: 3rem;
-            background-color: rgb(150, 108, 230);
-            width: fit-content;
-            color: white;
-            font-family: Silka;
-            font-size: 16px;
-        }
-
-        .content {
-            flex: 1;
-            display: flex;
-            margin: 2rem;
-            display: flex;
-            flex-direction: column;
-        }
-
-        #app-icon {
-            -webkit-user-drag: none;
-            margin: 1rem 0;
-        }
-
-        #title {
-            margin: 1rem 0;
-        }
-
-        #diagnostics {
-            margin: 1rem 0;
-        }
-
-        #details {
-            margin: 1rem 0;
-            flex: 1;
-            overflow-y: auto;
-            white-space: pre-line;
-            min-height: 50px;
-        }
-
-        .help {
-            color: #C4D1E8;
-            font-size: 0.8rem;
-            line-height: 1.5rem;
-        }
-
-        ::-webkit-scrollbar {
-            width: 8px;
-        }
-
-        ::-webkit-scrollbar-thumb {
-            background-color: #D8E3F5;
-            border-radius: 10px;
-        }
-
-        ::-webkit-scrollbar-track {
-            background-color: transparent;
-        }
-    </style>
-</head>
-
-<body>
-<div class="content">
-    <img id="app-icon"
-         alt="App icon"
-         height="70"
-         width="70"/>
-    <h2>Unfortunately an error has occurred in Bloom.</h2>
-    <hr/>
-    <p id="version"></p>
-    <pre id="diagnostics"></pre>
-    <pre id="errorType"></pre>
-    <pre id="details"></pre>
-    <button onclick="javascript:copy()">Copy</button>
-    <hr/>
-    <footer>
-        <p class="help">
-            Please visit <a href="#"
-                            onclick="javascript:window.error.openUrl('https://bloomwallet.io')">https://bloomwallet.io</a>
-            to get
-            help from the Bloom community.
-        </p>
-        <p class="help">
-            Alternatively report this problem at <a href="#"
-                                  onclick="javascript:window.error.openUrl('https://github.com/bloomwalletio/bloom/issues')">https://github.com/bloomwalletio/bloom/issues</a>
-        </p>
-    </footer>
-</div>
-<!-- https://github.com/electron/electron/issues/2863 -->
-<script>var exports = exports || {}</script>
-
-<script>
-    let errorData
-
-    window.error.getData().then((err) => {
-        errorData = err
-        document.getElementById('app-icon').src = errorData.iconPath
-        document.getElementById('version').textContent = `App Version: ${errorData.version}`
-        document.getElementById('diagnostics').textContent = errorData.diagnostics
-        document.getElementById('errorType').textContent = `Error Type: ${errorData.errorType}`
-        document.getElementById('details').textContent = formatError()
-    })
-
-    function formatError() {
-        let formatted = []
-
-        if (errorData.error) {
-            if (errorData.error instanceof Error || errorData.error.stack || errorData.error.message) {
-                if (errorData.error.stack) {
-                    formatted.push(errorData.error.stack)
-                } else if (errorData.error.message) {
-                    formatted.push(errorData.error.message)
-                }
-            } else if (typeof errorData.error == 'string') {
-                formatted.push(errorData.error)
-            } else {
-                formatted.push(JSON.stringify(errorData.error))
-            }
-        }
-
-        return formatted.join('\r\n')
-    }
-
-    function copy() {
-        let content = `App Version: ${errorData.version}\r\n\r\n`
-        content += errorData.diagnostics + '\r\n\r\n'
-        content += `Error Type: ${errorData.errorType}` + '\r\n\r\n'
-        content += formatError()
-        copyToClipboard(content)
-    }
-
-    function copyToClipboard(input) {
-        try {
-            const textArea = document.createElement('textarea')
-            textArea.value = input
-            document.body.appendChild(textArea)
-
-            if (navigator.userAgent.match(/ipad|iphone/i)) {
-                const range = document.createRange()
-                range.selectNodeContents(textArea)
-                const selection = window.getSelection()
-                selection.removeAllRanges()
-                selection.addRange(range)
-                textArea.setSelectionRange(0, 999999)
-            } else {
-                textArea.select()
-            }
-
-            document.execCommand('copy')
-            document.body.removeChild(textArea)
-        } catch (err) {
-        }
-    }
-</script>
-</body>
-
+    <head>
+        <meta charset="utf-8"/>
+        <meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no"/>
+        <meta
+            http-equiv="Content-Security-Policy"
+            content="
+                default-src 'self';
+                connect-src 'self';
+                img-src 'self';
+                base-uri 'self';
+                form-action 'none';
+                frame-src 'none';
+                worker-src 'none';
+                script-src 'self';
+                style-src-elem 'self';
+                style-src-attr 'none';
+                object-src 'none';
+                media-src 'self';
+                font-src 'self';
+                manifest-src 'self';
+                navigate-to 'self';
+                upgrade-insecure-requests;
+            "
+        />
+        <title>Bloom Error</title>
+        <link rel="stylesheet" href="error.css">
+    </head>
+    <body>
+        <div class="content">
+            <img id="app-icon"
+                alt="App icon"
+                height="70"
+                width="70"/>
+            <h2>Unfortunately an error has occurred in Bloom.</h2>
+            <hr/>
+            <p id="version"></p>
+            <pre id="diagnostics"></pre>
+            <pre id="errorType"></pre>
+            <pre id="details"></pre>
+            <button id="copyButton">Copy</button>
+            <hr/>
+            <footer>
+                <p class="help">
+                    Please visit 
+                    <a target="_blank" rel="external" href="https://bloomwallet.io">https://bloomwallet.io</a>
+                    to get help from the Bloom community.
+                </p>
+                <p class="help">
+                    Alternatively report this problem at 
+                    <a target="_blank" rel="external" href="https://github.com/bloomwalletio/bloom/issues">https://github.com/bloomwalletio/bloom/issues</a>
+                </p>
+            </footer>
+        </div>
+        <script src="error.js"></script>
+    </body>
 </html>
diff --git a/packages/desktop/public/error.js b/packages/desktop/public/error.js
new file mode 100644
index 0000000000..d78debfec9
--- /dev/null
+++ b/packages/desktop/public/error.js
@@ -0,0 +1,65 @@
+// https://github.com/electron/electron/issues/2863
+var exports = exports || {}
+
+let errorData
+
+window.error.getData().then((err) => {
+    errorData = err
+    document.getElementById('app-icon').src = errorData.iconPath
+    document.getElementById('version').textContent = `App Version: ${errorData.version}`
+    document.getElementById('diagnostics').textContent = errorData.diagnostics
+    document.getElementById('errorType').textContent = `Error Type: ${errorData.errorType}`
+    document.getElementById('details').textContent = formatError()
+})
+
+function formatError() {
+    let formatted = []
+
+    if (errorData.error) {
+        if (errorData.error instanceof Error || errorData.error.stack || errorData.error.message) {
+            if (errorData.error.stack) {
+                formatted.push(errorData.error.stack)
+            } else if (errorData.error.message) {
+                formatted.push(errorData.error.message)
+            }
+        } else if (typeof errorData.error == 'string') {
+            formatted.push(errorData.error)
+        } else {
+            formatted.push(JSON.stringify(errorData.error))
+        }
+    }
+
+    return formatted.join('\r\n')
+}
+
+function copy() {
+    let content = `App Version: ${errorData.version}\r\n\r\n`
+    content += errorData.diagnostics + '\r\n\r\n'
+    content += `Error Type: ${errorData.errorType}` + '\r\n\r\n'
+    content += formatError()
+    copyToClipboard(content)
+}
+
+function copyToClipboard(input) {
+    try {
+        const textArea = document.createElement('textarea')
+        textArea.value = input
+        document.body.appendChild(textArea)
+
+        if (navigator.userAgent.match(/ipad|iphone/i)) {
+            const range = document.createRange()
+            range.selectNodeContents(textArea)
+            const selection = window.getSelection()
+            selection.removeAllRanges()
+            selection.addRange(range)
+            textArea.setSelectionRange(0, 999999)
+        } else {
+            textArea.select()
+        }
+
+        document.execCommand('copy')
+        document.body.removeChild(textArea)
+    } catch (err) {}
+}
+
+copyButton.addEventListener('click', copy)