prosody
0b01f40df0f9
plugins/mod_http_file_share.lua

Find changesets by keywords by author, files, the commit message, revision number or hash, or revset expression.

Software / code / prosody

Comparison

plugins/mod_http_file_share.lua @ 13854:0b01f40df0f9 13.0

mod_http_file_share: Add media-src 'self' to Content-Security-Policy header This allows certain media files to be loaded when navigated to directly in a web browser. Note that in some browsers (Chrome), the media gets transformed internally into a HTML page with some basic styles, but these are blocked due to our default-src policy of 'none' Although this could be unblocked with style-src unsafe-inline, it is not our plan to fix this, because this would have negative security implications. The reason for our CSP is to prevent the file share service from being used to host malicious HTML/CSS/JS. Yes, CSS can be malicious. Our file share service is for uploading and downloading files, it is not a substitute for website/content hosting.
author Matthew Wild <mwild1@gmail.com>
date Fri, 18 Apr 2025 12:25:06 +0100
parent 13786:284b100acda1
comparison
equal deleted inserted replaced
13852:ce4b4c2863f3 13854:0b01f40df0f9
467 response.headers.content_range = response_range; 467 response.headers.content_range = response_range;
468 end 468 end
469 response.headers.accept_ranges = "bytes"; 469 response.headers.accept_ranges = "bytes";
470 470
471 response.headers.cache_control = "max-age=31556952, immutable"; 471 response.headers.cache_control = "max-age=31556952, immutable";
472 response.headers.content_security_policy = "default-src 'none'; frame-ancestors 'none';" 472 response.headers.content_security_policy = "default-src 'none'; media-src 'self'; frame-ancestors 'none';"
473 response.headers.strict_transport_security = "max-age=31556952"; 473 response.headers.strict_transport_security = "max-age=31556952";
474 response.headers.x_content_type_options = "nosniff"; 474 response.headers.x_content_type_options = "nosniff";
475 response.headers.x_frame_options = "DENY"; -- COMPAT IE missing support for CSP frame-ancestors 475 response.headers.x_frame_options = "DENY"; -- COMPAT IE missing support for CSP frame-ancestors
476 response.headers.x_xss_protection = "1; mode=block"; 476 response.headers.x_xss_protection = "1; mode=block";
477 477