Recorded on ٢ نوفمبر ٢٠٢٦
Close a hardening gap from the threat model
Coroid Expo's content security policy still allowed inline styles, a relaxation its own threat model listed. Coroid removed it without breaking the fonts visitors read in Arabic, Japanese and Chinese, and QA proved it in a real browser.
- To the pull request
- ٤٣ min
- To the merge
- ٧ h ٥٧ min
- Agent runs
- ٧
- Criteria verified
- ٨ of ٨
- Model spend
- ٠٫٥١ US$
- Change
- ١١ files, +٣٠٧ −٤٤
What was asked
Remove style-src 'unsafe-inline': styles from 'self' only and script-src unchanged. The locale fonts must still load in Arabic, Japanese and Chinese with no policy violation in a real browser, a test must fail if 'unsafe-inline' comes back, and the threat model must be updated.
What happened on the way
The plan turned the requested three-locale browser check into a check of one font, every planned criterion passed, and the pull request went out without it. Review caught the gap against the filed criteria. One requested change added a three-locale browser test with screenshots, and QA verified it in each locale.
The outcome
Merged. The policy sends style-src 'self' with script-src unchanged, the fonts load from a constructed stylesheet instead of style elements, the 2D mode renders in all three languages with no policy violation, and the security tests fail if 'unsafe-inline' returns. The threat model no longer lists the relaxation.
The record
- Pull request #200Made by CoroidMerged as 232f83692
- ٢ tasks recorded in Coroid
The repository is private, so this record names its pull requests and does not link them.