proposal(15): CSP + sandbox hardening

[christian-byrne]

Proposal #15: CSP + Sandbox Hardening

Security audit and hardening for the Electron app. This PR includes both a detailed proposal document and a working proof-of-concept implementation.

What This PR Does

1. Content Security Policy — Adds a strict CSP meta tag to index.html: script-src 'self' (no 'unsafe-inline'), default-src 'none', restrictive resource origins
2. Inline Script Extraction — Moves the 69-line inline <script> block from index.html:253-322 to renderer/init.js, enabling strict CSP without 'unsafe-inline'
3. Explicit Sandbox — Adds sandbox: true to both launcher and ComfyUI BrowserWindow configs (already default since Electron 20, but now explicit)
4. URL Validation — shell.openExternal now only allows http: and https: protocols, preventing file://, smb://, and custom protocol handler abuse
5. Path Validation — open-path IPC handler now resolves to absolute paths

Security Audit Findings (see proposal for full details)

Finding	Severity	Status
No Content Security Policy	HIGH	✅ Fixed
No explicit process sandbox	MEDIUM	✅ Fixed
Unvalidated shell.openExternal	MEDIUM	✅ Fixed
Unvalidated shell.openPath	LOW	✅ Fixed
No Electron fuses	MEDIUM	📋 Documented (build-time, future)
linkify() quote escaping gap	LOW	📋 Documented

Files Changed

• index.html — CSP meta tag + inline script → external file reference
• renderer/init.js — New — extracted initialization code
• main.js — sandbox: true on both BrowserWindow configs
• lib/ipc.js — URL protocol validation + path resolution
• .github/proposals/proposal-csp-security.md — Full security audit with IPC surface analysis, fuse recommendations, and migration roadmap

What's NOT in This PR (future work)

• Electron fuses (@electron/fuses) — requires build pipeline integration
• CSP headers for ComfyUI windows (they load http://127.0.0.1:PORT)
• IPC sender validation (verify message origin webContents)

Dependencies

Proposal #1 (electron-vite) is listed as a dependency but this PR actually works standalone — the inline script extraction was done manually without needing a bundler.

Concerns

• style-src 'unsafe-inline' is still needed because the codebase uses inline style attributes extensively. This is acceptable per Electron security guidelines.
• The GrantFileProtocolExtraPrivileges fuse (future) needs testing since the app uses loadFile() to load index.html.