From 99782ce209429bfb5b826d7abcf562359b035965 Mon Sep 17 00:00:00 2001 From: Raven Scott Date: Tue, 3 Mar 2026 03:18:17 -0500 Subject: [PATCH] Fix Firefox CSP upgrading ws:// to wss:// for local WebSocket connections Firefox's default MV3 CSP includes upgrade-insecure-requests, which upgrades ws://127.0.0.1 to wss:// and breaks SSH/RDP WebSocket connections to the local native host. Add explicit content_security_policy to manifest_firefox.json allowing ws://127.0.0.1:* and http://127.0.0.1:* on extension pages. --- extension/manifest_firefox.json | 3 +++ releases/Holesail-Browser-1.0.0.xpi | Bin 635409 -> 635477 bytes releases/Holesail-Browser-1.0.0.zip | Bin 635714 -> 635714 bytes 3 files changed, 3 insertions(+) diff --git a/extension/manifest_firefox.json b/extension/manifest_firefox.json index 25b5c50..bdc4841 100644 --- a/extension/manifest_firefox.json +++ b/extension/manifest_firefox.json @@ -89,6 +89,9 @@ "strict_min_version": "109.0" } }, + "content_security_policy": { + "extension_pages": "default-src 'self'; script-src 'self'; connect-src 'self' ws://127.0.0.1:* http://127.0.0.1:*;" + }, "host_permissions": [ "*://*.host.local/*", "*://*.hole.sail/*" diff --git a/releases/Holesail-Browser-1.0.0.xpi b/releases/Holesail-Browser-1.0.0.xpi index 89bad35f3419f50f27ff7be74bbf07586f0edbc2..09e9f0114013d020e95bada7aef16673b758706b 100644 GIT binary patch delta 1352 zcmV-O1-JT<=btx6yS1y91XXG6M>? zLMa2)7`Mwf2T%={j3NRWhcQ9}hcQ9~hcQA0w=qHnn)ZhqMhCYWMhLb`x9FJ&x&pV+ zkq8$EhoYPax1yX01Ox&$LYJtZ2_b*Mj@vd6z3*2Lx&&|{dF|azwwp^^^pHc+1}Sn1 z76L_$EoLcFB}euyf(7ys`NDijhmIlh&8%PQlL{rvuenFchg+}(1?K7V@e*j{4Ac3jDl39u+PQg8&< zRd2x7()npQs{VySVHrO6hePVX^kLHv4(vXNycoVq5Q^I{_)ox3@J~x39l*w#$ESq8 z??Yi>YLc<^RljwF93DZm2swWjy%-%pkZZSFN(E*908bGRYHoO|&`bB5!k2$na)U45 z^+f}t=30nN0LBmmDRk<31QuygH^zalF#i zYd_9M-E#FhYX9n#b!V#RtcoY0W-E1BAf-P9JI9LF zTXU&BEwJtf4M|@Fjrml!VRLJaqJmgZ3RZ{>oz=y15jU-mx<1@T?}u4^ouuds4^xV{ zw$(Wg$D=f&t;76~TO5BIpgWIyDCpn`l0p^=atqG1R=|l>{1*!09q7{7zGn|91XQaj9`!v(-C$ktK z3tLG}Wz#bpY7hYJDuZshI6A8{bDqc%Q;<`NxkAENI0Lux4A_6rk#J{l3mfW$Y8D6D zG;|X$?)7gS}FtMdeZ>dSuUj=EOBE7l2SzW_TQEcF{yn(A<;gQ!3xsWV006iN002-+0Rk-p6abggqzNLIAfyQzmk*^06PNI< z2?Uo>qzM`VcmbDfqzOI(Ed`gYqzNjQ0;CBZ0&NVD93Qt9r3o?xm+-9#1ecYn2^yDX zstFX6iNOn(&Z-Fvmq@A!9s;PomuRX9Ew|pP2|ogtYpn?ymp82m8ke7~2^5zZtqC3j z&$a=VpN|0-mklie3YS~02@JQhtqDm1mo~2n8V#*=0sv`aZ*FrhF*!1q(XR;#zwTmsGI{cnvl}V_ZHCiP>WV006j`*|7;S K20Ek(0000RtzB;b delta 1257 zcmV9zrxVwc&r0T8$IECJ?;w}Kf0MO>F4G6M>?eI*0C z1DBj40t>g&bporew?Zic)fktIA_5wRflmX6flma7flmduflmgS_O};815gcz8%77W z8%7AWOSg-Z2p0&q(UAzc0*9iU2)Ck~2?PWJp*okSpa~&=&2pPC5Wf2BgE5n>HWK%&xOJCn&wAEHm#C#fVbU~1f(*zeQsYPI``*9jqBK?UD{ z#%K#lb1A%Avb?l_paqx@?@s2RDbLAAC3hN>=g^Mr&4XDmtE~xWrg(`Ba=*AI?RKn$ zfLs$U2xdTk;@TV8a!Le6z6DZ%)->fJC7IMn{`~q)WC?;~`Zf&7kB85i>^Np*OLLwO z1`7FxGm4<==q0FvYnzrf(I1V;9mD$ma&YaK)-0RNj@=lM#_c)*mQ&?6e+7JipOq=n z0W6i=zj$W7c7d5JOc@g!^|dBMum@HlM3gnfr~w0i=_*Z)D@dYecMWL2CH20yNwd=%BznjtLXP=yA9OA* zkExs;pLBk0_gSkB=hs2mR^MRDMTadH$Jo_Phh5zqWAjB1G#?Hf93`ggIaRU}Nq3yO zBwb&B9MQsV>BmxH@T9wlJz6ePJ%(vCjW`Cnei;Mn4)xpaALE(s^m8+-?1kl{k!mmC zn=b@4#_FB7pj=p*W3Ag7n))ILjD~eo%*W zfr}<^n^K>vDiKjP9*JaC;qpVOuxo&N9(NFbo55qI6gY#(X5W-JSaz>g4DPe3&f;?GjPSvfTbA;eFj&5 zurZyGjpAS~4fO!-&C~Q`yMnoYVV|RjySL%dn|kX(t2!a;WNK70#|3j-E=R?(k;(c6 zj&upkzJ-wnM58~wbW&i?vM=e}N~)JNPl4aK@K-mh`4z0N(Y%$K7BOLMa<$mhRhI5Gq+vG1$O9u!D#C)V50{{RV2><|>52Xnzmt>>~8kbY02@{u*qzN7Z@&cE!qzOI( zrv{htqzNjQMx+TI0_P2p93Qt@r3o?xm({8X9+#@B2^5zHs|g#Ikg5q90$ahCtf~nq zw;rnrLjsqrtqB^Jd#wo?m*K4m7MESE2_6E1kC%O|2`snwtqDm1mwT@X8kbtH2@98? zuL%{GK(7fJ0&;nmT(1cqm$k16aF<`O2_6CsLYIHA2^*Isun8Uz!8iv1Z*X*JZ*Frg zXmo9CmyWOrg_l~f2^yCzu?Y~Dgs}+}mlLrG8UoIlmoKpiE0>tD33v^mI%8Z2#C)V5 T0{{RVmmRVRG6wde2><{9c5O4a diff --git a/releases/Holesail-Browser-1.0.0.zip b/releases/Holesail-Browser-1.0.0.zip index a120b8f3ac0e75b96e582a566b3bd44351e0dd7d..e6f9b4813a4418ff626ff8deec6f1c9d545a7434 100644 GIT binary patch delta 241 zcmX@~OzqG!wGG{CCRgtgnA~l_H{DNyk!|yxqsQ1bcdxOPoNQmk*L>j2_5)`ae*|oI zQeg680;$}-LzbzEsl7*uX?u?nbGQ8V(-!RAEYpE}sdhsrW*}w(V%F`3PHeNjwTIcV z12M<;Fk8-hxzmrW=9HTrw3<_7`j6F|!qZKFT&C>Jljp9Hoi4hbQ($`IYECJp=!4Ve zuIAL;&cB8;l6m^-^+2I{veS>R=Tx7bvL2}6hy3)G^_v6VVVv%}5on~rMoyOL l`5QSUrwakOf-~Hh88Vae^NRIN4UO~)^3u20Y~(z~2monHTTTD~ delta 242 zcmX@~OzqG!wGG{CHkWR;mE1gg%`LXc-D?CU+gI^5A2_r9z!}CL0n<~Ym;|>gD==j; zf#kODkY(~>YVT2E+TNqY+$}#H$dYQ`+QV$wftX`^ zm@VhM-0798IpwAYt>zS&zIrvMDO2ID$>j%Sr~hBgDKOn)HK!EQx}%flu92LcyPA_{ zJNFvSSmx>L*8_#;$xc7Lo>O^x%6d*YW(@_V>APi_q^8eb4^;JTJ*Nuebl;6Ya}73f nvP{q4$SFBp2*?#YXu-~qo0ylGmRek*msOmfx4mW~=P^bAx&U2i