diff options
| author |  Inverle <inverle@proton.me>
| 2025-08-11 19:35:54 +0200 |
|---|---|---|
| committer |  GitHub <noreply@github.com>
| 2025-08-11 19:35:54 +0200 |
| commit | 7df6c201f2e6a6521d20718dfd8d9794c7437d1f (patch) | |
| tree | fbd88eb2c462808b16e9ee476b3c619e3b2bb20c /p/api | |
| parent | 2b1b268fc27268197b8c86ed839bf22daab79438 (diff) | |
Put CSP everywhere (#7810)
* Puts CSP everywhere in `p/api`
* including the HTML query page ❗
* Also in `p/ext.php`
* Puts `X-Content-Type-Options: nosniff` everywhere
* Fixes custom icon configuration not showing `blob:` icon in statsController (idle feeds)
* Also removes `style-src 'unsafe-inline'` since it doesn't seem to be needed
* Improves CSP of `p/f.php`
* Add `sandbox` directive
Diffstat (limited to 'p/api')
| -rw-r--r-- | p/api/fever.php | 2 | ||||
| -rw-r--r-- | p/api/greader.php | 3 | ||||
| -rw-r--r-- | p/api/index.php | 2 | ||||
| -rw-r--r-- | p/api/pshb.php | 1 | ||||
| -rw-r--r-- | p/api/query.php | 7 |
5 files changed, 15 insertions, 0 deletions
diff --git a/p/api/fever.php b/p/api/fever.php index 6251842e7..92ddb82b8 100644 --- a/p/api/fever.php +++ b/p/api/fever.php @@ -1,5 +1,7 @@ <?php declare(strict_types=1); +header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); +header('X-Content-Type-Options: nosniff'); /** * Fever API for FreshRSS diff --git a/p/api/greader.php b/p/api/greader.php index 311f17a7c..40fb5dc72 100644 --- a/p/api/greader.php +++ b/p/api/greader.php @@ -28,6 +28,9 @@ Server-side API compatible with Google Reader API layer 2 require(__DIR__ . '/../../constants.php'); require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader +header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); +header('X-Content-Type-Options: nosniff'); + if (PHP_INT_SIZE < 8) { //32-bit /** @return numeric-string */ function hex2dec(string $hex): string { diff --git a/p/api/index.php b/p/api/index.php index fd9828080..def8d4890 100644 --- a/p/api/index.php +++ b/p/api/index.php @@ -1,5 +1,7 @@ <?php declare(strict_types=1); + header("Content-Security-Policy: default-src 'self'; frame-ancestors 'none'"); + header('X-Content-Type-Options: nosniff'); ?> <!DOCTYPE html> <html xmlns="http://www.w3.org/1999/xhtml" xml:lang="en-GB" lang="en-GB"> diff --git a/p/api/pshb.php b/p/api/pshb.php index 91dd4e901..b6cbc5089 100644 --- a/p/api/pshb.php +++ b/p/api/pshb.php @@ -6,6 +6,7 @@ require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader const MAX_PAYLOAD = 3_145_728; header('Content-Type: text/plain; charset=UTF-8'); +header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); header('X-Content-Type-Options: nosniff'); $ORIGINAL_INPUT = file_get_contents('php://input', false, null, 0, MAX_PAYLOAD) ?: ''; diff --git a/p/api/query.php b/p/api/query.php index 5deedc932..f7458e823 100644 --- a/p/api/query.php +++ b/p/api/query.php @@ -1,5 +1,8 @@ <?php declare(strict_types=1); + +header('X-Content-Type-Options: nosniff'); + require(__DIR__ . '/../../constants.php'); require(LIB_PATH . '/lib_rss.php'); //Includes class autoloader @@ -175,10 +178,12 @@ if (($_SERVER['REQUEST_METHOD'] ?? '') === 'OPTIONS') { if (in_array($format, ['rss', 'atom'], true)) { header('Content-Type: application/rss+xml; charset=utf-8'); + header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); $view->_layout(null); $view->_path('index/rss.phtml'); } elseif (in_array($format, ['greader', 'json'], true)) { header('Content-Type: application/json; charset=utf-8'); + header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); $view->_layout(null); $view->type = 'query/' . $token; $view->list_title = $query->getName(); @@ -190,9 +195,11 @@ if (in_array($format, ['rss', 'atom'], true)) { die(); } header('Content-Type: application/xml; charset=utf-8'); + header("Content-Security-Policy: default-src 'none'; frame-ancestors 'none'; sandbox"); $view->_layout(null); $view->_path('index/opml.phtml'); } else { + header("Content-Security-Policy: default-src 'self'; frame-src *; img-src * data:; frame-ancestors 'none'; media-src *"); $view->_layout('layout'); $view->_path('index/html.phtml'); } |