fix(security): enforce headers and safe content links

[JSONbored]

Motivation

• Prevent CSP bypass on dynamic HTML pages whose slugs look like static assets by ensuring SSR responses always get the shared security headers.
• Block contributor-supplied slugs and URLs that could enable same-origin script execution or unsafe popups by validating slugs and contributor URL schemes at content ingestion time.

Description

• Wrap TanStack/Nitro SSR responses with a withSecurityHeaders helper that applies applySecurityHeaders to every server response so CSP and other headers are always present (apps/web/src/server.ts).
• Add isHttpUrl and isSafeSlug helpers and enforce slug format (lowercase letters, numbers, hyphens only) along with http(s)-only checks for contributor-controlled URL fields and sourceUrls in the registry validator (packages/registry/src/content-schema.js).
• Add regression tests that assert the SSR wrapper is present and that validation rejects extension-like slugs and unsafe URL schemes (tests/crawler-policy.test.ts and tests/content-validation.test.ts).

Testing

• Ran unit/regression tests with pnpm exec vitest run tests/content-validation.test.ts tests/crawler-policy.test.ts and all tests passed.
• Ran content validation with pnpm validate:content:strict which validated existing content files successfully.
• Ran type checks with pnpm type-check (generate + tsc) which completed without errors.

---

Codex Task

[coderabbitai]

Warning

Review limit reached

@JSONbored, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 13 minutes and 20 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: b4294bfa-91bc-425f-846c-34e6da3db6a2

📥 Commits

Reviewing files that changed from the base of the PR and between 60c0a31 and 3218f63.

📒 Files selected for processing (4)

• apps/web/src/server.ts
• packages/registry/src/content-schema.js
• tests/content-validation.test.ts
• tests/crawler-policy.test.ts

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/propose-fix-for-csp-bypass-vulnerability

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[gittensory]

Note

Gittensory Gate skipped

PR closed before full evaluation. No late first comment was created.

Signal	Result	Evidence	Action
Gate result	⚠️ Skipped	#2119 is no longer open.	No action.

---

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[reviewwed]

🔍 Maintainer advisory review

Reviewed 4 changed file(s) — two independent AI reviewers. This is an advisory review — it does not merge or close the PR.

Suggested action: 🛠️ Request changes. Address the items below before merging.

Reviewer A · gpt-oss-120b — recommends 🛠️ request changes
The change adds a security‑header wrapper to all SSR responses and tightens content‑schema validation by enforcing safe slugs and restricting URL schemes to http/https. The header wrapper compiles if ./lib/security-headers exists, but the new slug validation may break existing entries that use uppercase, underscores, or other characters. Moreover, the URL validation relaxes the previous https‑only rule to allow plain http, which re‑introduces the risk of insecure resources and potential SSRF if those URLs are ever fetched server‑side. The added tests cover the new validation logic, but they don’t verify that existing content still passes, nor do they test the impact of allowing http URLs.

Suggestions

• Confirm that all existing content slugs already conform to the new safe‑slug regex; if not, migrate them or adjust the regex to be backward compatible.
• Consider keeping the original https‑only enforcement (or make http optional behind a flag) to avoid re‑introducing insecure links.
• Add a test that runs the full content validation suite on the current repository content to catch regressions early.
• Verify that ./lib/security-headers exports a function matching the expected signature; otherwise add a fallback or guard.

Worth double-checking

• CI failures due to previously accepted slugs now being rejected, halting releases.
• Introducing http URLs could allow mixed‑content or man‑in‑the‑middle attacks if the site later fetches those links.
• Potential SSRF if downstream code fetches user‑provided http URLs pointing to internal services.

Reviewer B · mistral-small-3.1-24b-instruct — recommends 🛠️ request changes
The change appears to correctly enforce security headers and validate content links, addressing potential security risks.

Suggestions

• Consider adding more detailed comments explaining the purpose of the new validation functions.
• Ensure that the applySecurityHeaders function is thoroughly tested for all edge cases.
• Add tests to verify that the security headers are correctly applied in various scenarios.

Worth double-checking

• Potential regression in the submission pipeline if the new validation logic is too strict.
• Ensure that the isSafeSlug regex is comprehensive enough to cover all edge cases.