fix(webapp): reject CSP-delimiter characters in the img-src allowlist

A CSP_IMG_SRC_ALLOWLIST entry containing ';' passed URL parsing and landed verbatim in the space-joined img-src directive, injecting or truncating a directive. Reject entries containing ';' or ',' alongside the existing wildcard and whitespace checks.

Author: kathiekiwi

apps/webapp/app/utils/cspImageOrigins.test.ts

@@ -50,12 +50,26 @@ describe("parseCspImageOrigins", () => {
     ["https://example.com#frag", "must be an origin only, with no path, query or hash"],
     ["example.com", "is not a valid absolute URL"],
     ["https://user:pw@example.com", "must not contain credentials"],
+    ["https://a.com;script-src", "must not contain ';' or ',' — these delimit CSP directives"],
   ])("rejects %s and says why", (value, reason) => {
     const { origins, rejected } = parseCspImageOrigins(value);
     expect(origins).toEqual([]);
     expect(rejected).toEqual([{ value, reason }]);
   });
 
+  it("does not let a ';' smuggle a second directive into img-src", () => {
+    const { origins } = parseCspImageOrigins("https://a.com;script-src");
+    expect(origins).toEqual([]);
+    expect(buildImgSrcDirective(origins)).not.toContain("script-src");
+  });
+
+  it("splits on ',' so a comma can never ride inside a single origin", () => {
+    // "https://a.com" is valid; the "x" fragment after the comma is rejected on its own.
+    const { origins } = parseCspImageOrigins("https://a.com,x");
+    expect(origins).toEqual(["https://a.com"]);
+    expect(origins.some((origin) => origin.includes(","))).toBe(false);
+  });
+
   it("keeps the valid entries when a sibling entry is rejected", () => {
     const { origins, rejected } = parseCspImageOrigins(
       "https://*.evil.com,https://sso.example.com"

apps/webapp/app/utils/cspImageOrigins.ts

@@ -73,6 +73,11 @@ function rejectionReason(value: string, allowHttp: boolean): string | undefined
   if (/\s/.test(value)) {
     return "contains whitespace";
   }
+  // `;` and `,` delimit CSP directives / source lists; an entry containing one would
+  // land verbatim in the space-joined img-src and inject or truncate a directive.
+  if (/[;,]/.test(value)) {
+    return "must not contain ';' or ',' — these delimit CSP directives";
+  }
 
   let url: URL;
   try {