PST-093: Content security policy hardening notes: data: images, base-uri, no violation reporting #822

New issue

Closed

opened 2026-10-10 10:56:59 +00:00 by tiagoagueda · 1 comment

tiagoagueda commented

2026-10-10 10:56:59 +00:00

Owner

Found in the security audit of 2026-10-10 (SECURITY-AUDIT-2026-10-10.md), run against main at c30851b from 8 to 10 October 2026, as PST-093. Severity: Informational.

The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it.

Severity: Informational
Category: csp
Location: src/postulo/config/settings/base.py (703-731)
Found by: XSS and CSP

Who can do it, and what they need. None on its own; these only widen what an injection elsewhere could use.

How it works.

img-src data: lets injected markup draw attacker images without a request (used legitimately by the CV photo in the preview, rendering.py/printing.py:448, and by allauth's TOTP QR code, allauth/elements/img.html). base-uri 'self' is fine since no <base> element exists, but 'none' would be stricter. There is no report-to/report-uri, so a violation in production is only visible in a browser console.

Impact. Negligible; recorded so the synthesis can say the policy was reviewed. No 'unsafe-inline', no 'unsafe-eval', script-src 'self' only, style nonce reaches the header only on the two preview views that read it (documents/views.py:340-347), frame-ancestors 'none' globally and 'self' only on the previews, object-src 'none', form-action 'self', no view or plugin relaxes it (only csp_override is …

Verification (verdict: confirmed; severity after verification: Informational). Not a vulnerability. Keep it as a coverage note. The only optional improvement is base-uri 'none', which is stylistic because no <base> element exists. The report-to omission is a reasonable choice for a self-hosted, privacy-first app with no reporting endpoint. The data: allowance in img-src is needed by the CV photo and the TOTP QR code and cannot exfiltrate anything. The cite printing.py:448 is correct.

Suggested remediation. Consider base-uri 'none', a report-to endpoint (even a log-only view) so production violations are seen, and keep data: images confined to the preview responses via a csp_override if the photo and the QR code are the only users.

Found in the security audit of 2026-10-10 (`SECURITY-AUDIT-2026-10-10.md`), run against `main` at `c30851b` from 8 to 10 October 2026, as **PST-093**. Severity: **Informational**. The text below is the audit's entry, unchanged apart from links to the other issues it names. The finding was produced by automated review and checked by a second automated pass; re-check it before acting on it. --- - **Severity:** Informational - **Category:** csp - **Location:** `src/postulo/config/settings/base.py` (703-731) - **Found by:** XSS and CSP **Who can do it, and what they need.** None on its own; these only widen what an injection elsewhere could use. **How it works.** img-src data: lets injected markup draw attacker images without a request (used legitimately by the CV photo in the preview, rendering.py/printing.py:448, and by allauth's TOTP QR code, allauth/elements/img.html). base-uri 'self' is fine since no <base> element exists, but 'none' would be stricter. There is no report-to/report-uri, so a violation in production is only visible in a browser console. **Impact.** Negligible; recorded so the synthesis can say the policy was reviewed. No 'unsafe-inline', no 'unsafe-eval', script-src 'self' only, style nonce reaches the header only on the two preview views that read it (documents/views.py:340-347), frame-ancestors 'none' globally and 'self' only on the previews, object-src 'none', form-action 'self', no view or plugin relaxes it (only csp_override is … **Verification** (verdict: confirmed; severity after verification: Informational). Not a vulnerability. Keep it as a coverage note. The only optional improvement is base-uri 'none', which is stylistic because no <base> element exists. The report-to omission is a reasonable choice for a self-hosted, privacy-first app with no reporting endpoint. The data: allowance in img-src is needed by the CV photo and the TOTP QR code and cannot exfiltrate anything. The cite printing.py:448 is correct. **Suggested remediation.** Consider base-uri 'none', a report-to endpoint (even a log-only view) so production violations are seen, and keep data: images confined to the preview responses via a csp_override if the photo and the QR code are the only users.

tiagoagueda added the

enhancement

security

labels

2026-10-10 10:57:00 +00:00

tiagoagueda referenced this issue

2026-10-10 10:57:45 +00:00

PST-041: Imports and remote metadata store URLs without a scheme check, and pages render them as href #770

tiagoagueda added this to the 1.0.0 milestone

2026-10-10 10:58:21 +00:00

tiagoagueda referenced this issue

2026-10-10 10:58:21 +00:00