From a0f9dd4cf218bcfbccbacd4cfc39dd4a3077ce21 Mon Sep 17 00:00:00 2001
From: Jonas Elfering <j.elfering@shopware.com>
Date: Thu, 15 Oct 2026 10:23:52 +0200
Subject: [PATCH 1/5] fix(media): align Apache static-asset CSP across recipes

---
 shopware/core/6.4/public/.htaccess.dist     | 8 +++++++-
 shopware/core/6.6/public/.htaccess.dist     | 8 +++++++-
 shopware/core/6.7/public/.htaccess.dist     | 8 +++++++-
 shopware/platform/6.4/public/.htaccess.dist | 8 +++++++-
 shopware/platform/6.6/public/.htaccess.dist | 8 +++++++-
 shopware/platform/6.7/public/.htaccess.dist | 8 +++++++-
 6 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/shopware/core/6.4/public/.htaccess.dist b/shopware/core/6.4/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/core/6.4/public/.htaccess.dist
+++ b/shopware/core/6.4/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/core/6.6/public/.htaccess.dist b/shopware/core/6.6/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/core/6.6/public/.htaccess.dist
+++ b/shopware/core/6.6/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/core/6.7/public/.htaccess.dist b/shopware/core/6.7/public/.htaccess.dist
index 4984a302..3e64081a 100644
--- a/shopware/core/6.7/public/.htaccess.dist
+++ b/shopware/core/6.7/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -37,8 +41,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/platform/6.4/public/.htaccess.dist b/shopware/platform/6.4/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/platform/6.4/public/.htaccess.dist
+++ b/shopware/platform/6.4/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/platform/6.6/public/.htaccess.dist b/shopware/platform/6.6/public/.htaccess.dist
index 62601e58..bf323130 100644
--- a/shopware/platform/6.6/public/.htaccess.dist
+++ b/shopware/platform/6.6/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
diff --git a/shopware/platform/6.7/public/.htaccess.dist b/shopware/platform/6.7/public/.htaccess.dist
index 4984a302..3e64081a 100644
--- a/shopware/platform/6.7/public/.htaccess.dist
+++ b/shopware/platform/6.7/public/.htaccess.dist
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -37,8 +41,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 

From bbde3fb687b50f110c1a6c4ecf0c60b542c0253e Mon Sep 17 00:00:00 2001
From: Jonas Elfering <j.elfering@shopware.com>
Date: Thu, 15 Oct 2026 11:43:08 +0200
Subject: [PATCH 2/5] fix(media): apply CSP to Fastly static asset responses

---
 README.md                                     |  6 +++
 .../6.4/config/fastly/deliver/default.vcl     |  5 +++
 .../6.5/config/fastly/deliver/default.vcl     |  5 +++
 .../6.6/config/fastly/deliver/default.vcl     |  5 +++
 .../6.7/config/fastly/deliver/default.vcl     |  5 +++
 .../6.8/config/fastly/deliver/default.vcl     |  5 +++
 tests/fastly-static-assets.sh                 | 43 +++++++++++++++++++
 7 files changed, 74 insertions(+)
 create mode 100644 tests/fastly-static-assets.sh

diff --git a/README.md b/README.md
index bb061ae0..03450110 100644
--- a/README.md
+++ b/README.md
@@ -2,6 +2,12 @@
 
 This repository is hosting Symfony Flex Recipes for Shopware 6. If you are new to Symfony Flex, please read the [blog post](https://www.shopware.com/en/news/shopware-goes-symfony-flex/).
 
+## Static asset Content Security Policy
+
+The Fastly recipes apply `Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'` to every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`, including cache hits and errors. Bundled HTML applications in these paths cannot execute scripts, submit forms or embed documents. Responses outside these paths retain their existing policy. Existing installations must update and deploy their Fastly snippets to receive this policy.
+
+Run the local delivery checks with `docker run --rm --entrypoint sh -v "$PWD":/source:ro -w /source ghcr.io/shopware/varnish:6.7 tests/fastly-static-assets.sh`. The test adapts Fastly-specific variables for Varnish; Fastly service validation is still required before activating the snippets.
+
 ## Available Recipes
 
 ### Shopware
diff --git a/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
index 8e60bce7..4b6976a0 100644
--- a/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
@@ -10,3 +10,8 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
+
+# Apply the asset policy to cached and uncached responses alike.
+if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+}
diff --git a/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
index 8e60bce7..4b6976a0 100644
--- a/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
@@ -10,3 +10,8 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
+
+# Apply the asset policy to cached and uncached responses alike.
+if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+}
diff --git a/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
index 8e60bce7..4b6976a0 100644
--- a/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
@@ -10,3 +10,8 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
+
+# Apply the asset policy to cached and uncached responses alike.
+if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+}
diff --git a/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
index 8e60bce7..4b6976a0 100644
--- a/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
@@ -10,3 +10,8 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
+
+# Apply the asset policy to cached and uncached responses alike.
+if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+}
diff --git a/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
index 74b48699..621affa0 100644
--- a/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
@@ -1,2 +1,7 @@
 # Remove the exact PHP Version from the response for more security (e.g. 404 pages)
 unset resp.http.x-powered-by;
+
+# Apply the asset policy to cached and uncached responses alike.
+if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
+}
diff --git a/tests/fastly-static-assets.sh b/tests/fastly-static-assets.sh
new file mode 100644
index 00000000..c329ca3d
--- /dev/null
+++ b/tests/fastly-static-assets.sh
@@ -0,0 +1,43 @@
+#!/bin/sh
+set -eu
+
+# This exercises the deliver snippets in Varnish; Fastly must still validate its own dialect.
+test_dir=$(mktemp -d)
+trap 'rm -rf "$test_dir"' EXIT
+policy="script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
+
+for snippet in shopware/fastly-meta/*/config/fastly/deliver/default.vcl; do
+    test_file=$test_dir/static-assets.vtc
+    {
+        echo "varnishtest \"Asset policy: $snippet\""
+        echo 'server s1 {'
+        for status in 200 200 200 200 200 200 200 200 200 200 404; do
+            echo 'rxreq'
+            echo "txresp -status $status -hdr \"Cache-Control: public, max-age=3600\" -hdr \"Content-Security-Policy: default-src 'self'\" -body response"
+        done
+        echo '} -start'
+        echo 'varnish v1 -vcl+backend {'
+        echo 'sub vcl_deliver {'
+        # Adapt only Fastly-specific variables; keep the complete deliver logic.
+        sed -e 's/req.url.path/regsub(req.url, "[?].*$", "")/g' \
+            -e 's/fastly.ff.visits_this_service/0/g' "$snippet"
+        echo '}'
+        echo '} -start'
+        echo 'client c1 {'
+        for path in /media/test.html /media/test.html /thumbnail/test.svg /theme/app.js /bundles/app/index.html /media/image.png /media/no-extension /media/test.html?download=1 /admin /application/rendered.html /media-other/test.html /media/missing.html; do
+            expected_policy=$policy
+            case "$path" in
+                /admin|/application/*|/media-other/*) expected_policy="default-src 'self'" ;;
+            esac
+            status=200
+            [ "$path" != /media/missing.html ] || status=404
+            echo "txreq -url \"$path\""
+            echo 'rxresp'
+            echo "expect resp.status == $status"
+            echo "expect resp.http.Content-Security-Policy == \"$expected_policy\""
+        done
+        echo '} -run'
+        echo 'varnish v1 -expect MAIN.cache_hit == 1'
+    } > "$test_file"
+    varnishtest "$test_file"
+done

From d2b78f46641e52b7687b113e97c2e335f1103cc8 Mon Sep 17 00:00:00 2001
From: Jonas Elfering <j.elfering@shopware.com>
Date: Thu, 15 Oct 2026 11:48:53 +0200
Subject: [PATCH 3/5] chore(tests): remove Fastly asset test harness

---
 README.md                     |  2 --
 tests/fastly-static-assets.sh | 43 -----------------------------------
 2 files changed, 45 deletions(-)
 delete mode 100644 tests/fastly-static-assets.sh

diff --git a/README.md b/README.md
index 03450110..ab34d3bf 100644
--- a/README.md
+++ b/README.md
@@ -6,8 +6,6 @@ This repository is hosting Symfony Flex Recipes for Shopware 6. If you are new t
 
 The Fastly recipes apply `Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'` to every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`, including cache hits and errors. Bundled HTML applications in these paths cannot execute scripts, submit forms or embed documents. Responses outside these paths retain their existing policy. Existing installations must update and deploy their Fastly snippets to receive this policy.
 
-Run the local delivery checks with `docker run --rm --entrypoint sh -v "$PWD":/source:ro -w /source ghcr.io/shopware/varnish:6.7 tests/fastly-static-assets.sh`. The test adapts Fastly-specific variables for Varnish; Fastly service validation is still required before activating the snippets.
-
 ## Available Recipes
 
 ### Shopware
diff --git a/tests/fastly-static-assets.sh b/tests/fastly-static-assets.sh
deleted file mode 100644
index c329ca3d..00000000
--- a/tests/fastly-static-assets.sh
+++ /dev/null
@@ -1,43 +0,0 @@
-#!/bin/sh
-set -eu
-
-# This exercises the deliver snippets in Varnish; Fastly must still validate its own dialect.
-test_dir=$(mktemp -d)
-trap 'rm -rf "$test_dir"' EXIT
-policy="script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
-
-for snippet in shopware/fastly-meta/*/config/fastly/deliver/default.vcl; do
-    test_file=$test_dir/static-assets.vtc
-    {
-        echo "varnishtest \"Asset policy: $snippet\""
-        echo 'server s1 {'
-        for status in 200 200 200 200 200 200 200 200 200 200 404; do
-            echo 'rxreq'
-            echo "txresp -status $status -hdr \"Cache-Control: public, max-age=3600\" -hdr \"Content-Security-Policy: default-src 'self'\" -body response"
-        done
-        echo '} -start'
-        echo 'varnish v1 -vcl+backend {'
-        echo 'sub vcl_deliver {'
-        # Adapt only Fastly-specific variables; keep the complete deliver logic.
-        sed -e 's/req.url.path/regsub(req.url, "[?].*$", "")/g' \
-            -e 's/fastly.ff.visits_this_service/0/g' "$snippet"
-        echo '}'
-        echo '} -start'
-        echo 'client c1 {'
-        for path in /media/test.html /media/test.html /thumbnail/test.svg /theme/app.js /bundles/app/index.html /media/image.png /media/no-extension /media/test.html?download=1 /admin /application/rendered.html /media-other/test.html /media/missing.html; do
-            expected_policy=$policy
-            case "$path" in
-                /admin|/application/*|/media-other/*) expected_policy="default-src 'self'" ;;
-            esac
-            status=200
-            [ "$path" != /media/missing.html ] || status=404
-            echo "txreq -url \"$path\""
-            echo 'rxresp'
-            echo "expect resp.status == $status"
-            echo "expect resp.http.Content-Security-Policy == \"$expected_policy\""
-        done
-        echo '} -run'
-        echo 'varnish v1 -expect MAIN.cache_hit == 1'
-    } > "$test_file"
-    varnishtest "$test_file"
-done

From f36a37ed7729aefd83e8e15761643825afae9a75 Mon Sep 17 00:00:00 2001
From: Jonas Elfering <j.elfering@shopware.com>
Date: Thu, 15 Oct 2026 13:00:52 +0200
Subject: [PATCH 4/5] fix(media): restrict Fastly CSP to uploaded media paths

---
 README.md                                                  | 2 +-
 shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl | 2 +-
 shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl | 2 +-
 shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl | 2 +-
 shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl | 2 +-
 shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl | 2 +-
 6 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/README.md b/README.md
index ab34d3bf..7e087f1f 100644
--- a/README.md
+++ b/README.md
@@ -4,7 +4,7 @@ This repository is hosting Symfony Flex Recipes for Shopware 6. If you are new t
 
 ## Static asset Content Security Policy
 
-The Fastly recipes apply `Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'` to every response under `/media/`, `/thumbnail/`, `/theme/` and `/bundles/`, including cache hits and errors. Bundled HTML applications in these paths cannot execute scripts, submit forms or embed documents. Responses outside these paths retain their existing policy. Existing installations must update and deploy their Fastly snippets to receive this policy.
+The Fastly recipes apply `Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'` to every response under `/media/` and `/thumbnail/`, including cache hits and errors. HTML documents in these paths cannot execute scripts, submit forms or embed documents. Responses outside these paths retain their existing policy. Existing installations must update and deploy their Fastly snippets to receive this policy.
 
 ## Available Recipes
 
diff --git a/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
index 4b6976a0..7e50880d 100644
--- a/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
@@ -12,6 +12,6 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
 }
 
 # Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+if (req.url.path ~ "^/(media|thumbnail)/") {
   set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
 }
diff --git a/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
index 4b6976a0..7e50880d 100644
--- a/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
@@ -12,6 +12,6 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
 }
 
 # Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+if (req.url.path ~ "^/(media|thumbnail)/") {
   set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
 }
diff --git a/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
index 4b6976a0..7e50880d 100644
--- a/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
@@ -12,6 +12,6 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
 }
 
 # Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+if (req.url.path ~ "^/(media|thumbnail)/") {
   set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
 }
diff --git a/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
index 4b6976a0..7e50880d 100644
--- a/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
@@ -12,6 +12,6 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
 }
 
 # Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+if (req.url.path ~ "^/(media|thumbnail)/") {
   set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
 }
diff --git a/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
index 621affa0..a3876308 100644
--- a/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
@@ -2,6 +2,6 @@
 unset resp.http.x-powered-by;
 
 # Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail|theme|bundles)/") {
+if (req.url.path ~ "^/(media|thumbnail)/") {
   set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
 }

From 1b7726fdbaf72aa79401421b661c540f0593829b Mon Sep 17 00:00:00 2001
From: Jonas Elfering <j.elfering@shopware.com>
Date: Thu, 15 Oct 2026 13:14:56 +0200
Subject: [PATCH 5/5] fix(media): preserve origin CSP without Fastly overrides

---
 README.md                                                  | 4 ----
 shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl | 5 -----
 shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl | 5 -----
 shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl | 5 -----
 shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl | 5 -----
 shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl | 5 -----
 6 files changed, 29 deletions(-)

diff --git a/README.md b/README.md
index 7e087f1f..bb061ae0 100644
--- a/README.md
+++ b/README.md
@@ -2,10 +2,6 @@
 
 This repository is hosting Symfony Flex Recipes for Shopware 6. If you are new to Symfony Flex, please read the [blog post](https://www.shopware.com/en/news/shopware-goes-symfony-flex/).
 
-## Static asset Content Security Policy
-
-The Fastly recipes apply `Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'` to every response under `/media/` and `/thumbnail/`, including cache hits and errors. HTML documents in these paths cannot execute scripts, submit forms or embed documents. Responses outside these paths retain their existing policy. Existing installations must update and deploy their Fastly snippets to receive this policy.
-
 ## Available Recipes
 
 ### Shopware
diff --git a/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
index 7e50880d..8e60bce7 100644
--- a/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.4/config/fastly/deliver/default.vcl
@@ -10,8 +10,3 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
-
-# Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail)/") {
-  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
-}
diff --git a/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
index 7e50880d..8e60bce7 100644
--- a/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.5/config/fastly/deliver/default.vcl
@@ -10,8 +10,3 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
-
-# Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail)/") {
-  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
-}
diff --git a/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
index 7e50880d..8e60bce7 100644
--- a/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.6/config/fastly/deliver/default.vcl
@@ -10,8 +10,3 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
-
-# Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail)/") {
-  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
-}
diff --git a/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
index 7e50880d..8e60bce7 100644
--- a/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.7/config/fastly/deliver/default.vcl
@@ -10,8 +10,3 @@ if (fastly.ff.visits_this_service == 0 && resp.http.sw-invalidation-states) {
   ## we don't want the client to cache
   set resp.http.Cache-Control = "no-cache, private";
 }
-
-# Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail)/") {
-  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
-}
diff --git a/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl b/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
index a3876308..74b48699 100644
--- a/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
+++ b/shopware/fastly-meta/6.8/config/fastly/deliver/default.vcl
@@ -1,7 +1,2 @@
 # Remove the exact PHP Version from the response for more security (e.g. 404 pages)
 unset resp.http.x-powered-by;
-
-# Apply the asset policy to cached and uncached responses alike.
-if (req.url.path ~ "^/(media|thumbnail)/") {
-  set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
-}