fix(security): resolve CSP syntax error and remove unreachable code by Chigael · Pull Request #990 · csxark/CryptoViz

Chigael · 2026-08-10T16:17:20Z

Pull Request

Description

This PR fixes syntax errors and unclosed brace structures in lib/security/contentSecurityPolicy.ts that were causing TypeScript compilation failures (TS1005: '}' expected).

Related Issue

Closes #963

Type of Change

Changes Made

Fixed the else brace structure so the throw new Error("CSPRNG not available") statement is properly scoped.
Removed the unreachable Math.random() loop (which is cryptographically insecure for CSP nonces).
Cleaned up trailing leftover call to globalThis.crypto.getRandomValues(randomValues).
spContainsUnsafeInline(): Removed duplicate, unreachable return statement with doubly-escaped regex.

Testing

Tested locally
No console errors
Existing functionality works as expected

Screenshots

If applicable, attach screenshots or screen recordings.

Checklist

My code follows the project guidelines.
I have tested my changes.
I have updated the documentation if required.
My changes address the related issue.
This PR focuses on a single issue.

Additional Notes

Add any additional information for reviewers here.

Summary by CodeRabbit

Bug Fixes
- Improved Content Security Policy validation for more accurate security directive and nonce checks.
- Corrected detection of unsafe inline content, including whitespace variations.
- Strengthened nonce generation by requiring secure browser cryptography.

vercel · 2026-08-10T16:17:24Z

@Chigael is attempting to deploy a commit to the csxark's projects Team on Vercel.

A member of the Team first needs to authorize it.

github-actions · 2026-08-10T16:17:36Z

🎉 Thank You for Your Contribution

Hello @Chigael,

Thank you for submitting a Pull Request to CryptoViz. We appreciate the time and effort you've invested in contributing to the project.

Your Pull Request has been received successfully and will be reviewed by the maintainers as soon as possible.

📋 Pull Request Checklist

✅ Linked the related issue
✅ No merge conflicts
✅ Synced with the latest main branch
✅ Build passes successfully
✅ All tests pass

Ensuring these requirements are met helps streamline the review process and enables maintainers to review your contribution more efficiently.

❤️ Support CryptoViz

If you find CryptoViz helpful, consider supporting the project by:

⭐ Starring the repository
🍴 Forking the repository
👤 Following Ark on GitHub
💼 Connecting on LinkedIn
🌐 Visiting the Portfolio

Your support helps increase the project's visibility and encourages continued development. Thank you for being a part of the CryptoViz community!

Thank you once again for contributing to CryptoViz. We appreciate your support and look forward to reviewing your contribution.

coderabbitai · 2026-08-10T16:17:50Z

Warning

Review limit reached

@Chigael, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 31 minutes

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 0f289566-db03-4bf8-be95-24b4a63c191b

📥 Commits

Reviewing files that changed from the base of the PR and between ac5756f and 30851f5.

📒 Files selected for processing (2)

lib/security/contentSecurityPolicy.ts
tests/unit/security/contentSecurityPolicy.test.ts

📝 Walkthrough

Walkthrough

The CSP security module now requires Web Crypto for nonce generation, detects actual whitespace in unsafe-inline, and applies boundary-aware validation for CSP directives and nonce values.

Changes

CSP validation

Layer / File(s)	Summary
CSP nonce and directive validation `lib/security/contentSecurityPolicy.ts`	The CSP result type formatting is unchanged semantically. Nonce generation now requires `globalThis.crypto.getRandomValues` and throws when unavailable. Unsafe-inline detection matches actual whitespace. Directive validation now requires directive boundaries, whitespace, and complete values.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related issues

lib/security/contentSecurityPolicy.ts has syntax error rendering CSP module inoperable #963 — This issue addresses the same nonce-generation and cspContainsUnsafeInline() defects in contentSecurityPolicy.ts.

Possibly related PRs

csxark/CryptoViz#156 — This PR also changes CSP security behavior by removing 'unsafe-inline' from script-src and adding CSP regression tests.

Suggested labels: ECSoC26-L2, needs review

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: fixing CSP syntax errors and removing unreachable code.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@lib/security/contentSecurityPolicy.ts`:
- Around line 131-134: Update the hasScriptNonce detection in the CSP validation
logic to recognize a nonce followed by additional script-src source expressions
such as strict-dynamic. Replace the directive-end requirement after the nonce
with a token boundary and allow the remaining directive values to be consumed,
while preserving matching across directive boundaries.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f29bdfc5-19ba-45ea-9df7-66f8b6507eb5

📥 Commits

Reviewing files that changed from the base of the PR and between eddaffe and 2b5681c.

📒 Files selected for processing (3)

lib/offline/precacheRoutes.ts
lib/security/contentSecurityPolicy.ts
public/sw.js

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

csxark · 2026-08-10T18:54:15Z

Hi @Chigael resolve the merge conflicts

Updated the last generated timestamp in the precache routes manifest.

…b.com/Chigael/CryptoViz into fix/csp-syntax-error-unreachable-code

Chigael · 2026-08-10T23:40:43Z

@csxark kindly reopen, so I can resolve conflict and then possible merge the PR

fix(security): resolve CSP syntax error and remove unreachable code

eddaffe

github-actions Bot added the needs review label Aug 10, 2026

update:fix CSP module syntax and nonce generation logic

2b5681c

coderabbitai Bot reviewed Aug 10, 2026

View reviewed changes

Comment thread lib/security/contentSecurityPolicy.ts

Update lib/security/contentSecurityPolicy.ts

02b2dd5

Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>

csxark approved these changes Aug 10, 2026

View reviewed changes

csxark added ECSoC26 Elite Coders Summer of Code 2026 and removed needs review labels Aug 10, 2026

Chigael and others added 4 commits August 10, 2026 20:01

Merge branch 'main' into fix/csp-syntax-error-unreachable-code

5b91253

Update last generated timestamp in precacheRoutes.ts

ac5756f

Updated the last generated timestamp in the precache routes manifest.

Fix regex for unsafe-inline in CSP validation

021c6ea

modify

a84a576

coderabbitai Bot mentioned this pull request Aug 10, 2026

fix(security): improve unsafe-inline CSP grammar detection #992

Merged

15 tasks

Chigael added 3 commits August 10, 2026 23:48

updates..csp fixes

67da601

Merge branch 'fix/csp-syntax-error-unreachable-code' of https://githu…

9d66f4e

…b.com/Chigael/CryptoViz into fix/csp-syntax-error-unreachable-code

update

30851f5

Navigation Menu

fix(security): resolve CSP syntax error and remove unreachable code - #990

fix(security): resolve CSP syntax error and remove unreachable code#990
Chigael wants to merge 10 commits into
csxark:mainfrom
Chigael:fix/csp-syntax-error-unreachable-code

Chigael commented Aug 10, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

vercel Bot commented Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 10, 2026

Uh oh!

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

csxark commented Aug 10, 2026

Uh oh!

Chigael commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Conversation

Chigael commented Aug 10, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Description

Related Issue

Type of Change

Changes Made

Testing

Screenshots

Checklist

Additional Notes

Summary by CodeRabbit

Uh oh!

vercel Bot commented Aug 10, 2026

Uh oh!

github-actions Bot commented Aug 10, 2026

🎉 Thank You for Your Contribution

📋 Pull Request Checklist

❤️ Support CryptoViz

Uh oh!

coderabbitai Bot commented Aug 10, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

❌ Failed checks (1 warning)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

csxark commented Aug 10, 2026

Uh oh!

Chigael commented Aug 10, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Chigael commented Aug 10, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 10, 2026 •

edited

Loading