fix(security): add worker-src to CSP so alphaTab-based plugins can render

[carochacs]

Summary

• Adds a worker-src 'self' blob:; directive to the site-wide Content-Security-Policy in server.py.

Root cause

The baseline CSP headers added in 81837ec (#44, stored-XSS fix) covered script-src, style-src, img-src, font-src, media-src, and connect-src, but never set worker-src. Per CSP fallback rules, workers without an explicit worker-src fall back to script-src, which allows 'self'/'unsafe-inline'/https: but not blob:.

alphaTab (used by the tabview and staffview plugins) spawns its rendering worker from a blob: URL. Without worker-src, browsers silently blocked that worker, so both plugins rendered a blank canvas — for every song and every arrangement, not anything instrument-specific.

Reported as "can't see the Sax arrangement in staffview or tabview" for the song Money. Reproduced the identical blank render on the Lead arrangement of the same song, confirming this is a general regression from the CSP change introduced in #44, not anything about the Sax arrangement's data.

Fix

Add worker-src 'self' blob:;, matching the blob: allowance already granted to img-src/media-src for the same reason (plugin-loaded CDN assets).

Test plan

• Rebuilt the Docker image and restarted the container with the fix applied.
• Loaded the song Money, selected the Sax arrangement, switched the active renderer to Tab View — full tablature now renders (measure numbers, tempo markings, tab lines) instead of a blank canvas.
• Verified Staff View renders as well.
• Confirmed the failure was general (not Sax-specific) by reproducing the same blank render on the Lead arrangement before the fix, and the same successful render after.

🤖 Generated with Claude Code

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3aa0d3d7-e422-4ac3-8b32-a5ed8f88f1a0

📥 Commits

Reviewing files that changed from the base of the PR and between 7af01ed and 0475afd.

📒 Files selected for processing (3)

• CHANGELOG.md
• server.py
• tests/test_security_headers.py

Included review availability: Your plan provides up to 1 included review per hour; 0 remain after this review.

---

📝 Walkthrough

Walkthrough

The baseline Content Security Policy now allows same-origin and blob: workers. Security-header tests verify allowed and rejected worker sources. The changelog documents the change and its effect on alphaTab rendering.

Changes

Worker CSP policy

Layer / File(s)	Summary
Add and validate worker sources server.py, tests/test_security_headers.py, CHANGELOG.md	The CSP permits 'self' and blob: workers. Tests reject http: and data: sources. The changelog records the update.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Merge Risk: ⚪ Minimal · up to 0475a

The PR adds the missing worker-src allowance needed for alphaTab-based tab and staff rendering, with focused coverage for the security header change. No actionable merge-blocking risk remains beyond normal checks and review.

Suggested reviewers: byrongamatos, chrisbewithyou

🚥 Pre-merge checks | ✅ 22

✅ Passed checks (22 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the CSP security fix and its purpose for alphaTab-based plugins.
Description check	✅ Passed	The description clearly covers the change, root cause, fix, and validation, but it omits the template's feedpak section and checklist.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Plugin Folder Name Matches Manifest Id	✅ Passed	The PR changes only CHANGELOG.md, server.py, and tests; all 12 tracked plugins//plugin.json IDs match their folder names at both base and head.
No Print()/Console.Log In Routes.Py	✅ Passed	The PR adds only a CSP string, tests, and changelog text; no added print(...) or traceback.print_exc(...) calls, and no setup(app, context) change appears in the diff.
Sibling Imports Use Load_sibling	✅ Passed	The PR diff changes only CHANGELOG.md, server.py, and tests/test_security_headers.py; no plugin-directory module adds an import of a plugin sibling.
Routes Namespaced Under /Api/Plugins/Id	✅ Passed	The PR diff adds no plugin routes or plugin manifests; it changes only CSP, CHANGELOG.md, and a security test. No new route path can violate the required prefixes.
Blocking Route Handlers Use Def Not Async	✅ Passed	The PR diff from origin/main changes only CHANGELOG.md, server.py, and tests/test_security_headers.py; no routes.py file or async route handler was modified.
Plugin.Json Version Bumped On Change	✅ Passed	The PR changes core server.py plus tests and CHANGELOG; origin is the core feedBack repository, whose docs identify plugins as separate repositories, so this plugin-version rule is inapplicable.
No Per-Frame Dom Queries In Draw/Raf	✅ Passed	The PR changes only CHANGELOG.md, server.py, and tests/test_security_headers.py; no .js file is modified, and no new MutationObserver is introduced.
Shortcuts Unregistered With Matching Scope	✅ Passed	The PR diff changes only CHANGELOG.md, server.py, and a CSP test; it adds no window.registerShortcut call, so the shortcut cleanup check is inapplicable.
Idempotent Guard On Top-Level Listeners	✅ Passed	The PR diff against origin/main changes only CHANGELOG.md, server.py, and tests/test_security_headers.py; no plugin screen.js file changes exist.
Server_files Entries Are Safe Relpaths	✅ Passed	The PR diff changes only CHANGELOG.md, server.py, and tests/test_security_headers.py; no plugin.json file is modified, so no server_files entry requires review.
Setrenderer Factory Has Init/Draw/Destroy	✅ Passed	The PR diff changes only server.py CSP, CHANGELOG.md, and a security-header test; no window.feedBackViz_ factory is added or modified.
Overlay Gates On Isdefaultrenderer Instructions	✅ Passed	The PR diff changes only CHANGELOG.md, server.py, and tests/test_security_headers.py; it adds no overlay drawing code or highway.project/fretX usage.
V3 Ui Mounts Via Playercontrolslot	✅ Passed	The complete PR diff adds only a CSP directive, changelog text, and a CSP test; no #player-controls injection or v3 mounting code was added.
New Feedpak Manifest Keys Declared In Spec	✅ Passed	The PR diff changes only CSP code, its test, and CHANGELOG.md; it adds no manifest key in the feedpak/sloppak implementation paths.
Feedpak Manifest Required Keys Present	✅ Passed	The PR diff changes only CSP, its security test, and CHANGELOG.md; it does not touch manifest-assembly code or feedBack-plugin-feedpakr.
Changelog Unreleased Section Updated	✅ Passed	The PR changes application behavior in server.py and adds a new Keep a Changelog bullet under CHANGELOG.md's [Unreleased] > Security section.
New Python Modules Have Pytest Coverage	✅ Passed	The PR adds no new Python module; it modifies existing server.py and adds tests/test_security_headers.py, so the stated new-module coverage condition is inapplicable.
No Hardcoded Secrets Or Tokens In Diff	✅ Passed	The diff adds only CSP, changelog, and test text; scans found zero AWS keys, PEM headers, or credential-variable assignments.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/csp-worker-src-alphatab-notation

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[pullfrog]

ℹ️ No critical issues — two small follow-ups inline.

Reviewed changes

• Adds worker-src 'self' blob: to the site-wide CSP (server.py:129). The root-cause analysis holds up: when worker-src is absent, worker loads fall back to child-src → script-src (MDN), and this policy's script-src ('self' 'unsafe-inline' https:) doesn't allow blob: — so alphaTab's blob:-minted rendering worker was blocked, matching the blank canvases in tabview/staffview.
• Security posture stays coherent. blob: was already granted to img-src/media-src, only same-origin scripts can mint blob: URLs, and script-src already permits inline execution — the incremental exposure is minimal and consistent with the header's documented rationale (server.py:105-117). Placement and formatting match the surrounding directives.

ℹ️ Nitpicks

• Adding an explicit worker-src narrows what previously fell back to script-src: cross-origin module workers from https: CDNs were technically permitted before and are blocked now. That looks like intentional, sensible tightening (classic workers can't be cross-origin anyway, and alphaTab loads its worker from a blob:), just noting it so it's a conscious choice.
• Per CSP2 §source-list-guid-matching, allowing blob: is spec-equivalent to unsafe-eval for worker creation. Accepted here given the existing posture above — worth remembering if script-src is ever tightened to nonce-based, at which point worker-src blob: deserves a second look too.

  ^{｜ Fix all ➔ ｜ Fix 👍s ➔ ｜ View workflow run ｜ Using Big Pickle (free) ｜ 𝕏}

[pullfrog]

✅ No new issues found.

Reviewed changes — incremental delta since the prior review (451b240..0475afd), which lands exactly the two follow-ups suggested there:

• Added a regression test pinning the new CSP directive (tests/test_security_headers.py). test_csp_allows_self_and_blob_workers parses worker-src out of the header with the same style as the existing script-src test and asserts 'self' + blob: are present while bare http:/data: are not. Verified it can fail (dropping the directive raises StopIteration) and that the full file suite passes.
• Added the [Unreleased] → Security CHANGELOG bullet documenting the blank-canvas root cause and the fix, placed right after the #47 baseline-CSP entries this builds on — matching the repo's Keep-a-Changelog convention.

Both prior threads are resolved by these changes; nothing outstanding on my side.

  ^{｜ View workflow run ｜ Using Big Pickle (free) ｜ 𝕏}

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.