Add Content-Security-Policy header to Excel taskpane add-in
Session from pi-for-excel-sessions on Hugging Face by thomasmustier · MIT · condensed by Coders Talk
Click a segment to jump to that moment
40msession
0interventions
GOAL
Understand prior security fixes (SSRF proxy guardrails, OAuth storage, markdown escaping) in an Excel AI sidebar add-in, and determine what else needs fixing without overengineering, particularly around CSP.
- +0Prompt · +0Help me understand recent security fixes to our Excel AI sidebar add-in, and figure out what else needs fixing, without chasing phantom issues.
- +0mAgent did · +0mExplored git history, proxy/auth code (cors-proxy, stream-proxy, oauth-storage, proxy-validation), markdown sanitization, extension API, and innerHTML usage sites to map the real attack surface.
- +15mPrompt · +15mTell me more about the CSP header, what is that?
- +15mAgent did · +15mExplained CSP in plain terms, enumerated the 8 external LLM/OAuth domains actually used by grepping source and vite config, and drafted a concrete CSP policy matching the app's real network needs.
- +17mPrompt · +17mBut I still want to allow the assistant to use web search and access code - how does that affect the CSP approach?
- +17mAgent did · +17mChecked tool registry and grepped for fetch() calls in tools/extensions - found zero, confirming all 11 built-in tools are local Office API calls with no outbound fetch. Concluded connect-src can be locked down now since web-access tools don't exist yet.
- +20mPrompt · +20mAre there easy mitigations, e.g. limiting which channels a tool can use to reach URLs, even if it can technically access any URL?
- +21mAgent did · +21mConfirmed zero fetch() calls across tools and extensions, then implemented CSP via a meta tag in taskpane.html and headers in vercel.json, verified the production build still generates the CSP correctly, and checked the extension loader only loads a bundled local extension (no external URL imports broken by the policy).
- +40mPrompt · +40mCan you commit these changes locally please? Make sure you ONLY commit these changes.
- +40mAgent did · +40mDiffed the full working tree, found many unrelated uncommitted changes, isolated and staged only src/taskpane.html and vercel.json, then committed just the CSP changes as 9c4c422 with lint and typecheck passing via pre-commit hooks.
- +40mOutcome · +40mCommitted CSP addition (2 files, 24 insertions) as 9c4c422, scoped away from other unrelated uncommitted changes; lint and typecheck passed.
VERDICT
I'd start next time by asking directly for a fetch()/network audit of tools and extensions before discussing CSP in the abstract - that grep for zero outbound fetch calls was what actually let me lock down connect-src confidently instead of guessing. The one correction that mattered was telling it to commit ONLY the CSP changes, since my working tree had a lot of unrelated in-progress work mixed in.