security: add Content-Security-Policy to all renderer pages

[Kirtan-pc]

Description

Fixes the missing Content-Security-Policy on all three renderer pages by adding a strict CSP meta tag that restricts sources to 'self' and blocks inline script execution.

Changes

• Added a CSP meta tag to index.html, settings.html, and onboarding.html.
• default-src 'self' restricts all resource loading to local files.
• script-src 'self' blocks inline scripts, inline event handlers, and eval(), closing the XSS vector for the innerHTML-built context menus and icon SVGs.
• style-src 'self' 'unsafe-inline' plus https://fonts.googleapis.com keeps the Google Fonts stylesheet and the inline style attributes that settings.html relies on for its layout working.
• font-src allows the Inter font files from https://fonts.gstatic.com.
• img-src 'self' data: allows the local theme previews and the data:image/svg+xml textures used in styles.css/settings.css.
• connect-src preserves the Google Fonts preconnect hints.
• Inline styles do not enable script execution in modern engines, so the strict script-src remains the effective XSS mitigation while keeping the UI functional.

Related Issue

Closes #400

Testing

• Verified all 43 unit tests pass with:

npm test

• Verified whitespace and formatting checks:

git diff --check

• Confirmed no inline scripts, inline event handlers, javascript: URIs, or eval()/new Function() usage exist in any renderer HTML or JavaScript.

Benefits

• Any future injection vector (e.g., a theme setting rendering user-provided strings) can no longer execute scripts, inline event handlers, or eval().
• Renderer pages are hardened against XSS without breaking the settings UI, Google Fonts, theme previews, or data-URI textures.
• The policy is uniform across all three pages and easy to audit.

[vercel]

@Kirtan-pc is attempting to deploy a commit to the Dot_NotSam's projects Team on Vercel.

A member of the Team first needs to authorize it.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one) (1)

• review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 2fa7e83f-64b2-43ee-b168-b91204feaeba

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🎉 Congratulations @Kirtan-pc! 🎉

Your pull request has been successfully merged into Paraline! Thank you so much for your valuable contribution and effort. Every single improvement helps make Paraline a better desktop experience for everyone! 🙌

🚀 What's Next?

• Keep the momentum going! Feel free to browse through our open Issues and grab another one that interests you!
• Support the Project: If you enjoyed contributing to Paraline, please take a second to star our repository! It helps increase the project's visibility and supports our community. ⭐

💬 Stay Connected:
Have any questions, want feedback, or just want to discuss further contributions? Feel free to reach out directly to the maintainer on Discord: dot_notsam!

Thank you again, and keep up the amazing work! 💻✨