fix(csp): allow generated-image R2 host in img-src so image-gen results render #3128

Merged

core-devops merged 1 commits from fix/csp-img-src-generated-images into main 2026-06-21 13:08:40 +00:00

Conversation 0 Commits 1 Files Changed 4

+212 -6

core-devops commented 2026-06-21 13:04:24 +00:00

Member

Copy Link

Copy Source

The bug

The tenant chat UI at https://<slug>.moleculesai.app/ served a CSP with img-src 'self' blob: data:. Generated images from the image-gen capability socket (RFC #3105) are returned as time-boxed, SigV4-presigned R2 GET URLs on <bucket>.<cf-account-hash>.r2.cloudflarestorage.com. The chat renders them as <img src="https://…r2.cloudflarestorage.com/…">, which the browser blocked because that host was not in img-src — broken thumbnail despite a valid image/png (HTTP 200, ~1.1MB). Pure CSP failure, not a content failure.

Fix

Add the generated-image R2 host to img-src in both CSP emitters that cover the canvas HTML page:

• canvas/src/middleware.ts — Next.js per-request CSP (the value seen in the bug report).
• workspace-server/internal/middleware/securityheaders.go — the Go front-door canvas-route CSP.

The combined tenant image returns both headers and browsers enforce the intersection of multiple CSP headers, so the host must be present in both or it is still blocked.

Why a wildcard (with an optional pin)

The exact host = MOLECULE_IMAGE_GEN_BUCKET + the CF R2 account hash (MOLECULE_IMAGE_GEN_ENDPOINT), both control-plane deploy config not known to the canvas build. So:

• A deploy MAY pin the exact origin via NEXT_PUBLIC_IMAGE_GEN_R2_HOST (canvas) / MOLECULE_IMAGE_GEN_R2_HOST (Go) — tightest policy, preferred when known.
• Otherwise we fall back to the documented https://*.r2.cloudflarestorage.com.

Security rationale

Only img-src (image display) is widened. connect-src is unchanged, so fetch()/XHR to R2 stays blocked — there is no data-exfiltration channel via this directive. The R2 URLs are short-lived, SigV4-presigned GETs scoped to a single object key the agent already legitimately holds; permitting the <img> to render them grants no new capability beyond viewing an image the user's own agent produced. script-src/style-src/connect-src/etc. are untouched.

Tests

• canvas/src/__tests__/csp-nonce.test.ts: img-src contains the R2 host (dev + prod); buildImgSrc() default wildcard vs pinned override; connect-src does NOT contain any R2 host.
• workspace-server/.../securityheaders_test.go: canvas CSP img-src has the R2 host (default + pinned), connect-src does not, API routes keep strict default-src 'self'.

Both suites green locally; go vet + tsc --noEmit clean.

Deploy / verify

Tenant UI CSP reaches prod via the standard core build → tenant image deploy. After deploy, verify:

curl -sI https://<slug>.moleculesai.app/ | grep -i content-security-policy
# img-src must now include https://*.r2.cloudflarestorage.com (or the pinned host)

Then generate an image in the chat and confirm the <img> renders (no CSP console error). Optionally set NEXT_PUBLIC_IMAGE_GEN_R2_HOST / MOLECULE_IMAGE_GEN_R2_HOST to the exact bucket origin to tighten from the wildcard.

🤖 Generated with Claude Code

## The bug The tenant chat UI at `https://<slug>.moleculesai.app/` served a CSP with `img-src 'self' blob: data:`. Generated images from the image-gen capability socket (RFC #3105) are returned as **time-boxed, SigV4-presigned R2 GET URLs** on `<bucket>.<cf-account-hash>.r2.cloudflarestorage.com`. The chat renders them as `<img src="https://…r2.cloudflarestorage.com/…">`, which the browser **blocked** because that host was not in `img-src` — broken thumbnail despite a valid `image/png` (HTTP 200, ~1.1MB). Pure CSP failure, not a content failure. ## Fix Add the generated-image R2 host to `img-src` in **both** CSP emitters that cover the canvas HTML page: - `canvas/src/middleware.ts` — Next.js per-request CSP (the value seen in the bug report). - `workspace-server/internal/middleware/securityheaders.go` — the Go front-door canvas-route CSP. The combined tenant image returns **both** headers and browsers enforce the **intersection** of multiple CSP headers, so the host must be present in both or it is still blocked. ### Why a wildcard (with an optional pin) The exact host = `MOLECULE_IMAGE_GEN_BUCKET` + the CF R2 account hash (`MOLECULE_IMAGE_GEN_ENDPOINT`), both **control-plane deploy config** not known to the canvas build. So: - A deploy MAY pin the exact origin via `NEXT_PUBLIC_IMAGE_GEN_R2_HOST` (canvas) / `MOLECULE_IMAGE_GEN_R2_HOST` (Go) — tightest policy, preferred when known. - Otherwise we fall back to the documented `https://*.r2.cloudflarestorage.com`. ### Security rationale Only `img-src` (image **display**) is widened. `connect-src` is **unchanged**, so `fetch()`/XHR to R2 stays blocked — there is no data-exfiltration channel via this directive. The R2 URLs are short-lived, SigV4-presigned GETs scoped to a single object key the agent already legitimately holds; permitting the `<img>` to render them grants no new capability beyond viewing an image the user's own agent produced. `script-src`/`style-src`/`connect-src`/etc. are untouched. ## Tests - `canvas/src/__tests__/csp-nonce.test.ts`: img-src contains the R2 host (dev + prod); `buildImgSrc()` default wildcard vs pinned override; **connect-src does NOT contain any R2 host**. - `workspace-server/.../securityheaders_test.go`: canvas CSP img-src has the R2 host (default + pinned), connect-src does not, **API routes keep strict `default-src 'self'`**. Both suites green locally; `go vet` + `tsc --noEmit` clean. ## Deploy / verify Tenant UI CSP reaches prod via the standard core build → tenant image deploy. After deploy, verify: ``` curl -sI https://<slug>.moleculesai.app/ | grep -i content-security-policy # img-src must now include https://*.r2.cloudflarestorage.com (or the pinned host) ``` Then generate an image in the chat and confirm the `<img>` renders (no CSP console error). Optionally set `NEXT_PUBLIC_IMAGE_GEN_R2_HOST` / `MOLECULE_IMAGE_GEN_R2_HOST` to the exact bucket origin to tighten from the wildcard. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

core-devops added 1 commit 2026-06-21 13:04:26 +00:00

fix(csp): allow generated-image R2 host in img-src so image-gen results render ... b0d5460b50

The tenant chat UI CSP set img-src to `'self' blob: data:` only. The image-gen
capability socket (RFC #3105) returns generated images as time-boxed,
SigV4-presigned R2 GET URLs on `<bucket>.<cf-account-hash>.r2.cloudflarestorage.com`.
The chat renders those as `<img src="https://…r2.cloudflarestorage.com/…">`,
which the browser blocked (broken thumbnail) even though the bytes are a valid
PNG — pure CSP failure, not a content failure.

Add the generated-image R2 host to img-src in BOTH CSP emitters that cover the
canvas HTML page:
  - canvas/src/middleware.ts (Next.js per-request CSP)
  - workspace-server .../securityheaders.go (Go front-door canvas-route CSP)
The combined tenant image returns both headers and browsers enforce the
intersection, so the host must be in both.

Host selection: the bucket + CF account hash are control-plane deploy config,
not known to the canvas build, so we cannot hardcode the exact origin. A deploy
MAY pin it (NEXT_PUBLIC_IMAGE_GEN_R2_HOST / MOLECULE_IMAGE_GEN_R2_HOST), tightest
policy; otherwise we fall back to the documented `https://*.r2.cloudflarestorage.com`.

Security: only img-src (image *display*) is widened. connect-src is unchanged,
so fetch()/XHR to R2 stays blocked — no exfiltration channel. The URLs are
short-lived signed GETs of a single object key the agent already holds.

Tests: extend csp-nonce.test.ts + securityheaders_test.go to assert the R2 host
is in img-src (default wildcard + pinned override) and is NOT in connect-src,
and that API routes keep the strict default-src 'self' policy.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

molecule-code-reviewer approved these changes 2026-06-21 13:06:30 +00:00

molecule-code-reviewer left a comment

Member

Copy Link

Copy Source

Reviewed: both CSP emitters (canvas middleware.ts buildCsp + workspace-server securityheaders.go) add the R2 host to img-src — correct, since browsers enforce the intersection of both headers. Only img-src widened; tests assert R2 present in img-src and ABSENT from connect-src. Pin via NEXT_PUBLIC_IMAGE_GEN_R2_HOST/MOLECULE_IMAGE_GEN_R2_HOST. Fixes the CSP-blocked generated-image display. LGTM.

Reviewed: both CSP emitters (canvas middleware.ts buildCsp + workspace-server securityheaders.go) add the R2 host to img-src — correct, since browsers enforce the intersection of both headers. Only img-src widened; tests assert R2 present in img-src and ABSENT from connect-src. Pin via NEXT_PUBLIC_IMAGE_GEN_R2_HOST/MOLECULE_IMAGE_GEN_R2_HOST. Fixes the CSP-blocked generated-image display. LGTM.

core-security approved these changes 2026-06-21 13:06:32 +00:00

core-security left a comment

Member

Copy Link

Copy Source

Security review: widening is img-src ONLY (display), connect-src UNCHANGED (no fetch/XHR exfil to R2 — test enforces this invariant). Presigned R2 GETs are time-boxed + SigV4-signed single-object reads. Wildcard *.r2.cloudflarestorage.com is acceptable (display-only, low exfil risk) and is tightenable to the exact bucket origin via the env pin — RECOMMEND setting NEXT_PUBLIC_IMAGE_GEN_R2_HOST + MOLECULE_IMAGE_GEN_R2_HOST to the prod bucket host to drop the wildcard. Approving.

Security review: widening is img-src ONLY (display), connect-src UNCHANGED (no fetch/XHR exfil to R2 — test enforces this invariant). Presigned R2 GETs are time-boxed + SigV4-signed single-object reads. Wildcard *.r2.cloudflarestorage.com is acceptable (display-only, low exfil risk) and is tightenable to the exact bucket origin via the env pin — RECOMMEND setting NEXT_PUBLIC_IMAGE_GEN_R2_HOST + MOLECULE_IMAGE_GEN_R2_HOST to the prod bucket host to drop the wildcard. Approving.

core-devops scheduled this pull request to auto merge when all checks succeed 2026-06-21 13:07:17 +00:00

core-devops merged commit 3cce3bd3c7 into main 2026-06-21 13:08:40 +00:00

core-devops referenced this issue from a commit 2026-06-21 15:41:41 +00:00

fix(csp): bake exact generated-image R2 host into tenant img-src pin (#3128 follow-up)

core-devops referenced this pull request 2026-06-21 15:42:00 +00:00

fix(csp): bake exact generated-image R2 host into tenant img-src pin (#3128 follow-up) #3131

Sign in to join this conversation.

Reviewers

No Reviewers

molecule-code-reviewer

core-security

Labels

Clear labels

area/ci

CI/CD pipeline issues

do-not-auto-merge

Opt out of autonomous merge-queue merging

kind/infrastructure

Infrastructure-related issues

merge-queue

Ready for serialized Gitea merge queue

merge-queue-hold

Temporarily hold PR in merge queue

platform/go

Go platform test issues

release-blocker

Blocks the staging→main promotion / a release

release-test

security

test-label-sre

tier:high

High risk per dev-sop §SOP-6 — ceo only, 24h cooldown

tier:low

Low risk per dev-sop §SOP-6 — engineers/managers/ceo can approve

tier:medium

Medium risk per dev-sop §SOP-6 — managers/ceo can approve

triage-test

test

wip

Work in progress — do not auto-merge

No Label

Milestone

No items

No Milestone

Projects

Clear projects

No project

Assignees

Clear assignees

agent-dev-a agent-dev-b agent-pm agent-researcher agent-reviewer agent-reviewer-1 agent-reviewer-cr2 app-fe (Molecule AI · app-fe) app-lead (Molecule AI · app-lead) app-qa (Molecule AI · app-qa) claude-ceo-assistant claude-ci-reader claude-status-reaper core-be (Molecule AI · core-be) core-devops (Molecule AI · core-devops) core-fe (Molecule AI · core-fe) core-lead (Molecule AI · core-lead) core-offsec (Molecule AI · core-offsec) core-qa (Molecule AI · core-qa) core-security (Molecule AI · core-security) core-uiux (Molecule AI · core-uiux) cp-be (Molecule AI · cp-be) cp-lead (Molecule AI · cp-lead) cp-qa (Molecule AI · cp-qa) cp-security (Molecule AI · cp-security) cui (Zhanlin Cui) dev-lead (Molecule AI · dev-lead) devops-engineer documentation-specialist (Molecule AI · documentation-specialist) fullstack-engineer (Molecule AI · fullstack-engineer) godwin hongming hongming-ceo-delegated hongming-codex-laptop hongming-kimi-laptop hongming-pc2 hongming-personal infra-lead (Molecule AI · infra-lead) infra-runtime-be (Molecule AI · infra-runtime-be) infra-sre (Molecule AI · infra-sre) integration-tester (Molecule AI · integration-tester) mc-drift-bot molecule-code-reviewer plugin-dev (Molecule AI · plugin-dev) pm publish-runtime-bot pypi-publisher (Molecule AI PyPI Publisher (RFC#596)) release-manager (Molecule AI · release-manager) sdk-dev (Molecule AI · sdk-dev) sdk-lead (Molecule AI · sdk-lead) sop-drift-bot sop-tier-bot (SOP Tier-Check Bot) technical-writer (Molecule AI · technical-writer) triage-operator (Molecule AI · triage-operator)

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: molecule-ai/molecule-core#3128