From 2b85a50ed72982ab0c0f9ef98c7ed1e15f21bf5f Mon Sep 17 00:00:00 2001 From: Inverle Date: Sat, 9 Aug 2025 21:47:39 +0200 Subject: Show warning when unsafe CSP policy is in use (#7804) * Show warning when unsafe CSP policy is in use * Fix bare markdown URL * i18n: fr * Minor i18n: fr * Add target="_blank" to i18n strings --------- Co-authored-by: Alexandre Alapetite --- docs/en/admins/10_ServerConfig.md | 18 ++++++++++++++++++ docs/i18n/flags/gen/cs.svg | 4 ++-- docs/i18n/flags/gen/ja.svg | 2 +- docs/i18n/flags/gen/ko.svg | 4 ++-- docs/i18n/flags/gen/ru.svg | 4 ++-- docs/i18n/flags/gen/zh-cn.svg | 4 ++-- docs/i18n/flags/gen/zh-tw.svg | 4 ++-- 7 files changed, 29 insertions(+), 11 deletions(-) (limited to 'docs') diff --git a/docs/en/admins/10_ServerConfig.md b/docs/en/admins/10_ServerConfig.md index 07ea147b6..54f4f0fb4 100644 --- a/docs/en/admins/10_ServerConfig.md +++ b/docs/en/admins/10_ServerConfig.md @@ -112,3 +112,21 @@ server { } } ``` + +## Security + +Avoid overwriting the [`Content-Security-Policy`](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/CSP) header with directives such as `more_set_headers "Content-Security-Policy: ..."` +This will likely make your FreshRSS instance vulnerable to event handler XSS attacks, since FreshRSS does not yet blacklist all event attributes. + +✅ Example of good CSP: `default-src 'self' frame-ancestors 'self'` +❌ Bad CSP: `upgrade-insecure-requests` + +Debug CSP header: +* With DevTools network tab: press F12 +* [CSP Evaluator](https://csp-evaluator.withgoogle.com/) + +If you're aware of the risks and want to ignore the warning shown to admin users, change the `suppress_csp_warning` setting to `true` in `./data/config.php` + +Note that FreshRSS already ships with a secure CSP configuration, therefore it's not necessary to make any adjustments to CSP unless you're writing an extension. + +For that, look into the [`Minz_ActionController::_csp`](https://github.com/FreshRSS/FreshRSS/blob/d9197d7e32a97f29829ffd4cf4371b1853e51fa2/lib/Minz/ActionController.php#L76-L96) function and use it in individual actions. diff --git a/docs/i18n/flags/gen/cs.svg b/docs/i18n/flags/gen/cs.svg index b997fd620..dba66087d 100644 --- a/docs/i18n/flags/gen/cs.svg +++ b/docs/i18n/flags/gen/cs.svg @@ -1,7 +1,7 @@ - - 🇨🇿 90% + + 🇨🇿 89% \ No newline at end of file diff --git a/docs/i18n/flags/gen/ja.svg b/docs/i18n/flags/gen/ja.svg index 82d7b683c..e14f6bd58 100644 --- a/docs/i18n/flags/gen/ja.svg +++ b/docs/i18n/flags/gen/ja.svg @@ -2,6 +2,6 @@ - 🇯🇵 97% + 🇯🇵 96% \ No newline at end of file diff --git a/docs/i18n/flags/gen/ko.svg b/docs/i18n/flags/gen/ko.svg index 7ad71b132..bde6a488c 100644 --- a/docs/i18n/flags/gen/ko.svg +++ b/docs/i18n/flags/gen/ko.svg @@ -1,7 +1,7 @@ - - 🇰🇷 90% + + 🇰🇷 89% \ No newline at end of file diff --git a/docs/i18n/flags/gen/ru.svg b/docs/i18n/flags/gen/ru.svg index b7b471ce1..01426a5df 100644 --- a/docs/i18n/flags/gen/ru.svg +++ b/docs/i18n/flags/gen/ru.svg @@ -1,7 +1,7 @@ - - 🇷🇺 90% + + 🇷🇺 89% \ No newline at end of file diff --git a/docs/i18n/flags/gen/zh-cn.svg b/docs/i18n/flags/gen/zh-cn.svg index 27e539722..41339b5f6 100644 --- a/docs/i18n/flags/gen/zh-cn.svg +++ b/docs/i18n/flags/gen/zh-cn.svg @@ -1,7 +1,7 @@ - - 🇨🇳 90% + + 🇨🇳 89% \ No newline at end of file diff --git a/docs/i18n/flags/gen/zh-tw.svg b/docs/i18n/flags/gen/zh-tw.svg index 66ddcb170..18374e310 100644 --- a/docs/i18n/flags/gen/zh-tw.svg +++ b/docs/i18n/flags/gen/zh-tw.svg @@ -1,7 +1,7 @@ - - 🇹🇼 90% + + 🇹🇼 89% \ No newline at end of file -- cgit v1.2.3