jvoisin eef084ee3d refactor(template): extract the CSP in a function and systematically use nonces. ... Having the CSP built in a function instead of in the template makes it easier to properly construct it. This was also the opportunity to switch from default-src 'self' to default-src 'none', to deny everything that isn't explicitly allowed, instead of allowing everything coming from 'self'. Moreover, as Miniflux is shoving the content of feeds in the same origin as itself, using self doesn't do much security-wise. It's much better to systematically use a nonce-based policy, so that an attacker able to bypass the sanitization will have to guess the nonce to gain arbitrary javascript execution. While the merge-request has been tested locally, it would still be prudent to thoroughly test it before merging, as it has the potential to break the user-interface should weird constructs be used.		2025-09-29 20:13:15 +02:00
..
common	refactor(template): extract the CSP in a function and systematically use nonces.	2025-09-29 20:13:15 +02:00
views	feat(ui): redirect back to original page after logging in	2025-09-26 20:20:34 -07:00