gitea-admin/gh-christianlouis-dmarq
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

address copilot review followups (#96)

Browse Source
This commit is contained in:
Christian Krakau-Louis
2026-05-18 19:17:36 +02:00
committed by GitHub
parent ee7c15ce4b
commit 181b43bff9
12 changed files with 245 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/XSS_FIXES.md
+2 -1
View File
@@ -239,7 +239,7 @@ After fixing the XSS issues, update your CSP header in `backend/app/middleware/s
### Current (Insecure)
```python
"script-src 'self' 'unsafe-inline' 'unsafe-eval'",
"script-src 'self' 'unsafe-inline' https://cdn.tailwindcss.com https://cdn.jsdelivr.net",
"style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
```
@@ -255,6 +255,7 @@ After fixing the XSS issues, update your CSP header in `backend/app/middleware/s
- [ ] All user input uses `textContent` not `innerHTML`
- [ ] No credentials stored in localStorage
- [ ] Inline styles replaced with CSS classes
- [x] CSP headers updated to remove 'unsafe-eval'
- [ ] CSP headers updated to remove 'unsafe-inline'
- [ ] Manual XSS testing completed
- [ ] Automated tests added