content-security-policy: default-src self; script-src self unsafe-inline; style-src self unsafe-inline; frame-ancestors none. No exploitable sink was found in this audit (titles escaped server- and client-side), so this is hardening: any future innerHTML slip becomes stored XSS. Note the inline theme-resolution script in the head currently requires it.
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
content-security-policy: default-src self; script-src self unsafe-inline; style-src self unsafe-inline; frame-ancestors none. No exploitable sink was found in this audit (titles escaped server- and client-side), so this is hardening: any future innerHTML slip becomes stored XSS. Note the inline theme-resolution script in the head currently requires it.
### Repro
```
curl -sk --resolve palette-dev.archfox.org:443:10.0.1.47 -D- -o /dev/null https://palette-dev.archfox.org/new | grep -i content-security-policy
```
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
fen
added spent time 5 seconds2026-09-10 03:49:08 +00:00
fen
added the Low label 2026-09-10 03:49:49 +00:00
Fix proposal: move the small inline boot script into /static/app.js and restrict script-src to self (drop unsafe-inline). style-src unsafe-inline is still needed for the runtime-generated theme swatch backgrounds unless swatches move to CSS custom properties on data-preset.
Fix proposal: move the small inline boot script into /static/app.js and restrict script-src to self (drop unsafe-inline). style-src unsafe-inline is still needed for the runtime-generated theme swatch backgrounds unless swatches move to CSS custom properties on data-preset.
fen
added spent time 5 seconds2026-09-10 13:50:33 +00:00
fen
added the In Progress label 2026-09-10 13:50:33 +00:00
fen
added spent time 4 minutes2026-09-10 13:54:26 +00:00
fen
added spent time 4 minutes2026-09-10 13:57:36 +00:00
ZERO CSP violations / console errors on /new, /history, /mine, /settings, /admin, paste view, attachment paste view. All 10 external scripts (/static/theme.js topbar.js foot.js paste.js new.js history.js mine.js settings.js admin.js unlock.js) load 200 — no 404s, go:embed intact.
Theme grid: 5 pair cards, 50 swatches, correct distinct light/dark colors (verified computed rgb per card in both modes). Theme switching works (card click sets preset).
Dark toggle (topbar + settings): toggles document dark state, persists via localStorage across reload.
Admin page: lock-only on fresh load (key input, no auto panel).
History: renders with rows + pagination.
/new scripts load; editor functional. NOTE found during QA: the UI Create button is broken on dev, but this is a PRE-EXISTING bug from merge 22c6624 (PR #129 added a $("#iscan") guard into create() while the iscan checkbox was dropped in merge f1b5dd0) — it crashes on the pre-#159 build too, unrelated to this CSP change. Server-side create API works (201); paste view, copy, raw, attachment render all clean. Filing a separate issue for the create-button crash.
QA PASS — verified live on palette-dev (image digest 1200177b3d1c = CI docker run for merge commit 5a227e2; PR #159 merged into dev).
Rendered-output verification (headless chromium via CDP, every page):
- CSP header now: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self' data:; frame-ancestors 'none' — no unsafe-inline.
- ZERO CSP violations / console errors on /new, /history, /mine, /settings, /admin, paste view, attachment paste view. All 10 external scripts (/static/theme.js topbar.js foot.js paste.js new.js history.js mine.js settings.js admin.js unlock.js) load 200 — no 404s, go:embed intact.
- Theme grid: 5 pair cards, 50 swatches, correct distinct light/dark colors (verified computed rgb per card in both modes). Theme switching works (card click sets preset).
- Dark toggle (topbar + settings): toggles document dark state, persists via localStorage across reload.
- Admin page: lock-only on fresh load (key input, no auto panel).
- History: renders with rows + pagination.
- /new scripts load; editor functional. NOTE found during QA: the UI Create button is broken on dev, but this is a PRE-EXISTING bug from merge 22c6624 (PR #129 added a $("#iscan") guard into create() while the iscan checkbox was dropped in merge f1b5dd0) — it crashes on the pre-#159 build too, unrelated to this CSP change. Server-side create API works (201); paste view, copy, raw, attachment render all clean. Filing a separate issue for the create-button crash.
Merged, deployed, closing. fix-139 branch deleted.
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
content-security-policy: default-src self; script-src self unsafe-inline; style-src self unsafe-inline; frame-ancestors none. No exploitable sink was found in this audit (titles escaped server- and client-side), so this is hardening: any future innerHTML slip becomes stored XSS. Note the inline theme-resolution script in the head currently requires it.
Repro
Found during exploratory security/bug pass on palette-dev (2026-09-09). Reporting only, no fix attached.
Fix proposal: move the small inline boot script into /static/app.js and restrict script-src to self (drop unsafe-inline). style-src unsafe-inline is still needed for the runtime-generated theme swatch backgrounds unless swatches move to CSS custom properties on data-preset.
QA PASS — verified live on palette-dev (image digest 1200177b3d1c = CI docker run for merge commit 5a227e2; PR #159 merged into dev).
Rendered-output verification (headless chromium via CDP, every page):
22c6624(PR #129 added a $("#iscan") guard into create() while the iscan checkbox was dropped in mergef1b5dd0) — it crashes on the pre-#159 build too, unrelated to this CSP change. Server-side create API works (201); paste view, copy, raw, attachment render all clean. Filing a separate issue for the create-button crash.Merged, deployed, closing. fix-139 branch deleted.