prosody
0b01f40df0f9
.lua-format
Software / code / prosody
File
.lua-format @ 13854:0b01f40df0f9 13.0
mod_http_file_share: Add media-src 'self' to Content-Security-Policy header
This allows certain media files to be loaded when navigated to directly in a
web browser.
Note that in some browsers (Chrome), the media gets transformed
internally into a HTML page with some basic styles, but these are blocked due
to our default-src policy of 'none' Although this could be unblocked with
style-src unsafe-inline, it is not our plan to fix this, because this would
have negative security implications.
The reason for our CSP is to prevent the file share service from being used to
host malicious HTML/CSS/JS. Yes, CSS can be malicious.
Our file share service is for uploading and downloading files, it is not a
substitute for website/content hosting.
| author | Matthew Wild <mwild1@gmail.com> |
|---|---|
| date | Fri, 18 Apr 2025 12:25:06 +0100 |
| parent | 13377:81ae5e12550f |
line wrap: on
line source
align_args: false align_parameter: false align_table_field: true break_after_functioncall_lp: false break_after_functiondef_lp: false break_after_operator: false break_after_table_lb: true break_before_functioncall_rp: false break_before_functiondef_rp: false break_before_table_rb: true chop_down_kv_table: true chop_down_parameter: false chop_down_table: true column_limit: 150 column_table_limit: 120 continuation_indent_width: 1 double_quote_to_single_quote: false extra_sep_at_table_end: true indent_width: 1 keep_simple_control_block_one_line: true keep_simple_function_one_line: true line_breaks_after_function_body: 1 line_separator: input single_quote_to_double_quote: false spaces_around_equals_in_field: true spaces_before_call: 1 spaces_inside_functioncall_parens: false spaces_inside_functiondef_parens: false spaces_inside_table_braces: true tab_width: 1 table_sep: ";" use_tab: true
