Skip to content

fix(media): apply CSP to all static asset responses #49

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Jonas Elfering (keulinho) wants to merge 3 commits into from
Closed

fix(media): apply CSP to all static asset responses #49

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
248a769
fix(media): apply CSP to all static asset responses
keulinho Oct 15, 2026
9dde4c8
chore(tests): remove static asset test harness
keulinho Oct 15, 2026
26244fb
fix(media): restrict Varnish CSP to uploaded media paths
keulinho Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 4 additions & 0 deletions 6.7/rootfs/etc/varnish/default.vcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -175,6 +175,10 @@ sub vcl_backend_response {
}

sub vcl_deliver {
if (req.url ~ "^/(media|thumbnail)/") {
set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
}

## we don't want the client to cache anything except assets and store-api responses
if (resp.http.Cache-Control !~ "private" && req.url !~ "^/(theme|media|thumbnail|bundles|store-api)/") {
set resp.http.Pragma = "no-cache";
Expand Down
4 changes: 4 additions & 0 deletions 6.8/rootfs/etc/varnish/default.vcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,10 @@ sub vcl_backend_response {
}

sub vcl_deliver {
if (req.url ~ "^/(media|thumbnail)/") {
set resp.http.Content-Security-Policy = "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'";
}

unset resp.http.xkey;
unset resp.http.X-Varnish;
unset resp.http.Via;
Expand Down
4 changes: 4 additions & 0 deletions README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,10 @@
The image bases on the official [Varnish image](https://hub.docker.com/_/varnish) and contains the Shopware default VCL.
The containing VCL is for the usage with xkeys.

## Static asset Content Security Policy

Responses under `/media/` and `/thumbnail/` receive `Content-Security-Policy: script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'`, including cache hits and error responses. This applies to every file type in these directories. HTML documents in these paths cannot execute scripts, submit forms or embed documents. Responses outside these paths retain their existing policy.

<details>
<summary>Config for Shopware 6.7</summary>

Expand Down