fix: reject CSP override sources that could break out of the meta attribute

The source allowlist blocked the CSP separators but not " < >, so a source
could escape the content="..." attribute and inject markup. Exclude those
chars too, and drop the now-redundant cast in cspMeta.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: redmodd

packages/tessera-learn/src/plugin/csp.ts

@@ -19,9 +19,10 @@ export const WEB_CSP_BASELINE: Record<string, string[]> = {
 };
 
 // Reject the separators (whitespace ends a source, ';' ends a directive, ','
-// ends a policy) so a stray char can't inject directives when sources are joined.
+// ends a policy) so a stray char can't inject directives when sources are joined,
+// plus " < > so a source can't break out of the content="..." meta attribute.
 const CSP_DIRECTIVE = /^[a-zA-Z][a-zA-Z-]*$/;
-const CSP_SOURCE = /^[^\s;,]+$/;
+const CSP_SOURCE = /^[^\s;,"<>]+$/;
 
 export function isCspOverrides(v: unknown): v is Record<string, string[]> {
   return (

packages/tessera-learn/src/plugin/index.ts

@@ -278,9 +278,7 @@ function readExportStandard(read: CourseConfigRead): string {
 // `false` drops the meta for deployments that set a CSP header themselves.
 function cspMeta(read: CourseConfigRead): string {
   if (readExportStandard(read) !== 'web') return '';
-  const csp = read.ok
-    ? (read.config.export as { csp?: unknown } | undefined)?.csp
-    : undefined;
+  const csp = read.ok ? read.config.export?.csp : undefined;
   if (csp === false) return '';
   return `\n  <meta http-equiv="Content-Security-Policy" content="${buildCsp(csp)}" />`;
 }

packages/tessera-learn/tests/csp.test.ts

@@ -63,5 +63,25 @@ describe('isCspOverrides', () => {
     expect(isCspOverrides({ 'font-src': ["'self' https://x"] })).toBe(false);
     expect(isCspOverrides({ '': ["'self'"] })).toBe(false);
     expect(isCspOverrides({ 'font src': ["'self'"] })).toBe(false);
+    // A " or > would break out of the content="..." meta attribute into markup.
+    expect(
+      isCspOverrides({ 'font-src': ['https://x"><script>alert(1)</script>'] }),
+    ).toBe(false);
+  });
+
+  it('accepts the legitimate source forms', () => {
+    for (const src of [
+      "'self'",
+      "'unsafe-inline'",
+      "'none'",
+      'https:',
+      'data:',
+      'blob:',
+      'https://fonts.gstatic.com',
+      "'nonce-abc123=='",
+      "'sha256-AbC+/dEf='",
+    ]) {
+      expect(isCspOverrides({ 'font-src': [src] })).toBe(true);
+    }
   });
 });