Skip to content

docs(hosting): align static asset CSP on 6.5 #2615

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Jonas Elfering (keulinho) wants to merge 1 commit into from
Closed

docs(hosting): align static asset CSP on 6.5 #2615

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions resources/references/config-reference/server/apache.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -20,3 +20,25 @@ The document root must always point to the public folder, to ensure all function
CustomLog ${APACHE_LOG_DIR}/shopware.access.log combined
</VirtualHost>
```

Enable `mod_rewrite` and `mod_headers`, and deploy the current `public/.htaccess` from the Shopware template.
The following additions restrict existing HTML files under `media/` and `thumbnail/`, and apply the same policy to SVG files.
Place the rewrite condition and rule before the existing rule that serves files directly; keep the header directives in the `mod_headers` block.

```apache
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -f
RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
</IfModule>

<IfModule mod_headers.c>
Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
<FilesMatch "\.(?i:svg)$">
Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
</FilesMatch>
</IfModule>
```

These rules leave application-rendered HTML and bundled HTML applications unchanged.
Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted.
21 changes: 18 additions & 3 deletions resources/references/config-reference/server/nginx.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,6 +4,10 @@
The document root must always point to the public folder, to ensure all functionality works.
:::

The static-file policy below restricts SVG files and HTML files under `media/` and `thumbnail/`.
Missing HTML media files return 404; application-rendered HTML and bundled HTML applications retain their own response policies.
Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions; images and styles remain permitted.

```text
server {
listen 80;
Expand Down Expand Up @@ -37,6 +41,14 @@
}
}

# Stored HTML must not affect pages rendered by PHP.
location ~* ^/(media|thumbnail)/.*[.]html$ {
try_files $uri =404;
expires 1y;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
}

location ~ ^/(theme|media|thumbnail|bundles|css|fonts|js|recovery|sitemap)/ {
expires 1y;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
Expand All @@ -48,13 +60,13 @@
open_file_cache_errors off;

location ~* ^.+\.svg {
add_header Content-Security-Policy "script-src 'none'";
add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
log_not_found off;
}
}

location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|svg|webp|html|woff|woff2|xml)$ {
location ~* ^.+\.(?:css|cur|js|jpe?g|gif|ico|png|webp|html|woff|woff2|xml)$ {

Check warning on line 69 in resources/references/config-reference/server/nginx.md

View workflow job for this annotation

GitHub Actions / LanguageTool

[LanguageTool] resources/references/config-reference/server/nginx.md#L69 

File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
Suggestions: `CSS`
URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
Category: CASING
Raw output 
resources/references/config-reference/server/nginx.md:69:24: File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
 Suggestions: `CSS`
 URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
 Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
 Category: CASING

Check warning on line 69 in resources/references/config-reference/server/nginx.md

View workflow job for this annotation

GitHub Actions / LanguageTool

[LanguageTool] resources/references/config-reference/server/nginx.md#L69 

File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
Suggestions: `JS`
URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
Category: CASING
Raw output 
resources/references/config-reference/server/nginx.md:69:32: File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
 Suggestions: `JS`
 URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
 Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
 Category: CASING

Check warning on line 69 in resources/references/config-reference/server/nginx.md

View workflow job for this annotation

GitHub Actions / LanguageTool

[LanguageTool] resources/references/config-reference/server/nginx.md#L69 

File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
Suggestions: `GIF`
URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
Category: CASING
Raw output 
resources/references/config-reference/server/nginx.md:69:41: File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
 Suggestions: `GIF`
 URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
 Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
 Category: CASING

Check warning on line 69 in resources/references/config-reference/server/nginx.md

View workflow job for this annotation

GitHub Actions / LanguageTool

[LanguageTool] resources/references/config-reference/server/nginx.md#L69 

File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
Suggestions: `PNG`
URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
Category: CASING
Raw output 
resources/references/config-reference/server/nginx.md:69:49: File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
 Suggestions: `PNG`
 URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
 Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
 Category: CASING

Check warning on line 69 in resources/references/config-reference/server/nginx.md

View workflow job for this annotation

GitHub Actions / LanguageTool

[LanguageTool] resources/references/config-reference/server/nginx.md#L69 

File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
Suggestions: `HTML`
URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
Category: CASING
Raw output 
resources/references/config-reference/server/nginx.md:69:58: File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
 Suggestions: `HTML`
 URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
 Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
 Category: CASING

Check warning on line 69 in resources/references/config-reference/server/nginx.md

View workflow job for this annotation

GitHub Actions / LanguageTool

[LanguageTool] resources/references/config-reference/server/nginx.md#L69 

File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
Suggestions: `XML`
URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
Category: CASING
Raw output 
resources/references/config-reference/server/nginx.md:69:74: File types are normally capitalized. (FILE_EXTENSIONS_CASE[1])
 Suggestions: `XML`
 URL: https://languagetool.org/insights/post/spelling-capital-letters/ 
 Rule: https://community.languagetool.org/rule/show/FILE_EXTENSIONS_CASE?lang=en-US&subId=1
 Category: CASING
expires 1y;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";

Expand All @@ -75,7 +87,10 @@
}

location ~* ^.+\.svg$ {
add_header Content-Security-Policy "script-src 'none'";
try_files $uri /index.php$is_args$args;
expires 1y;
add_header Cache-Control "public, must-revalidate, proxy-revalidate";
add_header Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
}

location / {
Expand Down
Loading