Found during a security audit (session that produced PR #44).
Issue: No Content-Security-Policy (or other security headers) is set anywhere in server.py. Only two unrelated plugin routes set X-Content-Type-Options elsewhere in the ecosystem.
Impact: Missing defense-in-depth against any future/residual XSS — a CSP would have limited the blast radius of the stored-XSS bug fixed in PR #44 (retune modal) even before that fix landed.
Suggested fix: Add a baseline CSP (and X-Content-Type-Options: nosniff, X-Frame-Options) to server.py's responses. Needs care given the plugin ecosystem's use of inline scripts/styles and third-party CDN loads (see the SRI-hash issues filed against feedBack-plugin-piano, -staffview, -tabview) — a CSP rollout would need to account for those.
Found during a security audit (session that produced PR #44).
Issue: No
Content-Security-Policy(or other security headers) is set anywhere inserver.py. Only two unrelated plugin routes setX-Content-Type-Optionselsewhere in the ecosystem.Impact: Missing defense-in-depth against any future/residual XSS — a CSP would have limited the blast radius of the stored-XSS bug fixed in PR #44 (retune modal) even before that fix landed.
Suggested fix: Add a baseline CSP (and
X-Content-Type-Options: nosniff,X-Frame-Options) toserver.py's responses. Needs care given the plugin ecosystem's use of inline scripts/styles and third-party CDN loads (see the SRI-hash issues filed againstfeedBack-plugin-piano,-staffview,-tabview) — a CSP rollout would need to account for those.