fix(security): 2 improvements across 2 files

[tomaioo]

Summary

fix(security): 2 improvements across 2 files

Problem

Severity: High | File: src/renderer/chooser.html:L6

The chooser.html file uses a very permissive Content-Security-Policy that allows 'unsafe-inline' for scripts and styles, and 'unsafe-eval' for scripts. This significantly weakens the security benefits of CSP and could allow XSS attacks if any user-controlled data reaches the renderer.

Solution

Remove 'unsafe-inline' and 'unsafe-eval' from the CSP. Use nonce or hash-based CSP for inline scripts. If 'unsafe-eval' is needed for a specific library, consider using a safer alternative or sandboxing that code.

Changes

• src/renderer/chooser.html (modified)
• src/renderer/index.html (modified)

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[lacymorrow]

Reviewed the CSP changes. A couple of notes before merging:

feather-icons eval dependency: vendor/feather/feather-icons.min.js contains Function('return this')() in its UMD global detection. In Electron renderers with node integration enabled, typeof module === 'object' is true so feather uses the CommonJS path and this eval code is likely bypassed. But it's worth testing to confirm the renderer loads correctly after this change.

chooser.html script-src change: The new CSP adds https: to script-src in chooser.html (script-src 'self' https:). That actually broadens script loading to any HTTPS URL, which is more permissive than intended for a local renderer. Recommend using just 'self' there to match index.html.

Suggest testing the renderer (both the main window and the crosshair chooser) with these CSP changes before merging.