[Jonas Elfering (keulinho)]

1. Why is this change necessary?

Static assets are served directly by the webserver and do not receive application response policies. HTML and SVG should use a consistent policy, scoped so that application-rendered pages and bundled HTML applications keep their existing behavior.

2. What does this change do, exactly?

Add an existing-file matcher to the Shopware chart's generated Caddyfile for SVG and HTML under media/ and thumbnail/, sending script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'. This chart supplies its own Caddyfile and therefore needs the same policy as the Docker image. Application-rendered HTML and bundled HTML applications retain their own response policies.

Images and styles remain permitted. Custom static documents must work without scripts, embedded documents, base URL overrides or form submissions.

3. Describe each step to reproduce the issue or behaviour.

1. Serve an existing HTML file under media/ or thumbnail/, and an SVG file.
2. Check the response for the full CSP above.
3. Open a bundled HTML application or an application-rendered page; its response policy should retain its existing behavior.

Validation: Rendered the actual template using its helpers and default values in a focused temporary chart; Helm lint passes. Native Caddy validation and 12 real HTTP cases pass. The runtime fixture removes the unrelated tracing block because the test Caddy lacks that module. No complete dependency-chart render or Kubernetes deployment.

4. Please link to the relevant issues (if any).

• fix(media): apply CSP to static HTML and SVG assets shopware#21659
• fix(installer): align static HTML and SVG CSP web-installer#33
• fix(media): align Apache static-asset CSP across recipes recipes#270
• docs(security): document stored asset CSP and CDN requirements docs#2613
• fix(webserver): align static HTML and SVG CSP docker#245

5. Checklist

• I have tested the changed configuration
• I have checked that rendered HTML and bundled HTML applications retain their behavior
• I have checked whitespace and syntax where applicable
• Complete repository CI before merging

[l.tepner (sw54904)]

Jonas Elfering (@keulinho) Have you considered adding frame-ancestors to the strengthened CSP? Esp. HTML media files may become vulnerable to click jacking, but may break allowed embeds and captured by potential higher/global level configurations.