Harden wallet_connect.html with CSP, integrity checks, & network allowlist
Labels: security, frontend, priority/high
Difficulty: Medium · Effort: M
Backlog slot: 54
Problem Statement
wallet_connect.html is a 110-line single-file demo with hard-coded styles, inline JS, and a permissive Freighter detection (typeof window.freighter !== 'undefined'). No Content Security Policy, no SRI.
Why it Matters
- A UI shipped alongside a financial contract should at least have basic hardening.
Technical Context
- Inline scripts (no CSP) → XSS-prone.
- If a service worker / extension that polls
window.freighter is compromised, user address can be exfiltrated.
Expected Outcome
- Move JS to external file w/ SHA-256 pin.
- Add
<meta http-equiv="Content-Security-Policy">.
- Validate Stellar address with StrKey library before accepting.
- Disallow custom regex that doesn't check ED25519 checksum.
Acceptance Criteria
Files Likely Affected
wallet_connect.html- New:
wallet_connect.js
Dependencies
None.
Harden
wallet_connect.htmlwith CSP, integrity checks, & network allowlistLabels:
security,frontend,priority/highDifficulty: Medium · Effort: M
Backlog slot: 54
Problem Statement
wallet_connect.htmlis a 110-line single-file demo with hard-coded styles, inline JS, and a permissive Freighter detection (typeof window.freighter !== 'undefined'). No Content Security Policy, no SRI.Why it Matters
Technical Context
window.freighteris compromised, user address can be exfiltrated.Expected Outcome
<meta http-equiv="Content-Security-Policy">.Acceptance Criteria
Files Likely Affected
wallet_connect.htmlwallet_connect.jsDependencies
None.