From fe038b2104fa87070484319241515fbfabf4ceb3 Mon Sep 17 00:00:00 2001
From: Jonas Elfering <j.elfering@shopware.com>
Date: Thu, 15 Oct 2026 10:23:52 +0200
Subject: [PATCH] fix(installer): align static HTML and SVG CSP

---
 Resources/install-template/htaccess | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/Resources/install-template/htaccess b/Resources/install-template/htaccess
index eed61cf..8330e2e 100644
--- a/Resources/install-template/htaccess
+++ b/Resources/install-template/htaccess
@@ -20,6 +20,10 @@ DirectoryIndex index.php
     RewriteCond %{ENV:REDIRECT_STATUS} ^$
     RewriteRule ^index\.php(?:/(.*)|$) %{ENV:BASE}/$1 [R=301,L]
 
+    # Restrict stored HTML without affecting responses rendered by the application.
+    RewriteCond %{REQUEST_FILENAME} -f
+    RewriteRule ^(?:media|thumbnail)/.*\.(?i:html)$ - [E=SHOPWARE_STATIC_HTML:1]
+
     # If the requested filename exists, simply serve it.
     # We only want to let Apache serve files and not directories.
     RewriteCond %{REQUEST_FILENAME} -f
@@ -36,8 +40,10 @@ DirectoryIndex index.php
 </IfModule>
 
 <IfModule mod_headers.c>
+    Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'" env=SHOPWARE_STATIC_HTML
+
     <FilesMatch "\.(?i:svg)$">
-        Header set Content-Security-Policy "script-src 'none'"
+        Header set Content-Security-Policy "script-src 'none'; object-src 'none'; frame-src 'none'; base-uri 'none'; form-action 'none'"
     </FilesMatch>
 </IfModule>
 
@@ -83,4 +89,4 @@ DirectoryIndex index.php
   </IfModule>
 </IfModule>
 
-# END Shopware
\ No newline at end of file
+# END Shopware