kevinveenbirkenbachandClaude Opus 5.5 7a95245390 fix(web-app-dashboard): fetch an external branding host through the onion mirror ...

With the asset and design services off (dashboard variant 1) the logo falls back to service_provider.platform.logo, which without web-svc-asset is the public https://file.infinito.nexus/assets. network_url leaves a host the node does not serve unchanged and port-ui embeds it as is, so the onion dashboard requested clearnet https://file.infinito.nexus/assets/img/logo.png and network-leak.spec.js failed in four jobs of fork run 40042690056 (Gitea#1, OpenProject#1, Mastodon#1, XWiki#1). Pure tor mode loads the same URL; its leak spec only runs with more than one pass.

csp.yml now lists the asset service URL under img-src. build_csp_header does not read img-src, so the header is unchanged; external_asset_origins does, which puts the host on the web-svc-mirror allowlist and into the onion body filter's rewrite to http://mirror.<onion>/file.infinito.nexus, the path every other third-party asset of an onion page takes. A deployed web-svc-asset resolves to the node's own file domain, which external_asset_origins skips. test_branding_mirror_origin.py covers both cases.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-24 15:58:30 +02:00

..

filter_plugins

…

__init__.py

…

test_branding_mirror_origin.py

fix(web-app-dashboard): fetch an external branding host through the onion mirror

2026-10-24 15:58:30 +02:00