mirror of
https://github.com/miniflux/v2.git
synced 2025-09-30 19:22:11 +00:00
eef084ee3d
Having the CSP built in a function instead of in the template makes it easier to properly construct it. This was also the opportunity to switch from default-src 'self' to default-src 'none', to deny everything that isn't explicitly allowed, instead of allowing everything coming from 'self'. Moreover, as Miniflux is shoving the content of feeds in the same origin as itself, using self doesn't do much security-wise. It's much better to systematically use a nonce-based policy, so that an attacker able to bypass the sanitization will have to guess the nonce to gain arbitrary javascript execution. While the merge-request has been tested locally, it would still be prudent to thoroughly test it before merging, as it has the potential to break the user-interface should weird constructs be used. |
||
|---|---|---|
| .. | ||
| templates | ||
| engine.go | ||
| functions.go | ||
| functions_test.go | ||