From 69a6dd1463bb3107605ac581990544078438fa77 Mon Sep 17 00:00:00 2001 From: lebaudantoine Date: Thu, 11 Jun 2026 14:43:35 +0200 Subject: [PATCH] =?UTF-8?q?=F0=9F=A9=B9(frontend)=20fix=20missing=20defaul?= =?UTF-8?q?t-src=20in=20CSP=20configuration?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The CSP was missing a default-src directive (flagged by CodeRabbit). Without it, styles, images, fonts, and media are completely unrestricted, which undercuts the otherwise strict policy. Set default-src to 'self' and add an explicit style-src directive since we rely on inline styles (e.g. #close-msg and the view toggling use inline style attributes), so style-src needs to allow 'self' and 'unsafe-inline'. --- docker/dinum-frontend/nginx/default.conf | 2 +- src/helm/extra/templates/frontend_nginx_cm.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/docker/dinum-frontend/nginx/default.conf b/docker/dinum-frontend/nginx/default.conf index 6daead5c..76619fb9 100644 --- a/docker/dinum-frontend/nginx/default.conf +++ b/docker/dinum-frontend/nginx/default.conf @@ -48,7 +48,7 @@ server { set $nonce $request_id; - set $csp "upgrade-insecure-requests; "; + set $csp "default-src 'self'; upgrade-insecure-requests; "; set $csp "${csp}frame-ancestors ${ms_domains}; "; set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; "; set $csp "${csp}connect-src 'self' ${ms_domains}; "; diff --git a/src/helm/extra/templates/frontend_nginx_cm.yaml b/src/helm/extra/templates/frontend_nginx_cm.yaml index 3ca49de1..ede7cd6e 100644 --- a/src/helm/extra/templates/frontend_nginx_cm.yaml +++ b/src/helm/extra/templates/frontend_nginx_cm.yaml @@ -56,7 +56,7 @@ data: set $nonce $request_id; - set $csp "upgrade-insecure-requests; "; + set $csp "default-src 'self'; upgrade-insecure-requests; "; set $csp "${csp}frame-ancestors ${ms_domains}; "; set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; "; set $csp "${csp}connect-src 'self' ${ms_domains}; ";