git/list[1] front-page[2] threads[3] people[4] search[5] about
 

Re: Implementing CSP (Content Security Policy) for gitweb in the future

From
Jakub Narebski <jnareb@gmail.com>
Date
Jun 5, 2011, 13:33 UTC
Message-ID
<201106051533.51735.jnareb@gmail.com>
In-Reply-To
<1307278350.23564.5.camel@localhost>
On Sun, 5 July 2011, Matt McCutchen wrote:
> On Sun, 2011-06-05 at 11:03 +0200, Jakub Narebski wrote:
Show 10 quoted lines
> > In the future however it might be better solution for gitweb to implement
> > (as an option) support for CSP (Content Security Policy), which IIRC did
> > not exists in 2009, in addition to current $prevent_xss.
> 
> Sure.  CSP is not a substitute for designing to prevent harmful HTML
> injection, but a mitigation for some of its worst effects in case some
> injection points are overlooked.  There's no reason not to enable it by
> default with $prevent_xss, though third parties adding functionality to
> gitweb would need to know to disable it or modify the policy
> accordingly.

I propose CSP support _in addition to_ and not replacing $prevent_xss (which would be nice to have more fine-grained control over).

Well, while we can whitelist HTML fragment from README.html, or render README.md / README.rs / README.pod etc. instead of blocking it like gitweb currently does if $prevent_xss is enabled, I don't think it would be feasible to do the same for text/html 'blob_plain' pages.

Serving HTML pages etc. from 'blob_plain' view with path_info links is quite useful feature; this way one can use gitweb as a cheap and easy way to deploy web pages and web apps; or just test results of development. CSP would serve this purpose well; current $prevent_xss behavior of serving as attachment (forcing download), or serving them as text/plain as e.g. GitHub does simply remove this feature.

-- 
Jakub Narebski
Poland
Previous: Matt McCutchenNext: Matt McCutchen
Message 6 of 14 in “gitweb: Fix usability of $prevent_xss”
  1. gitweb: Fix usability of $prevent_xssJakub Narebski, Jun 4, 2011
  2. Prevalence of $prevent_xssMatt McCutchen, Jun 4, 2011
  3. Jakub NarebskiJun 4, 2011
  4. Implementing CSP (Content Security Policy) for gitweb in the futureJakub Narebski, Jun 5, 2011
  5. Matt McCutchenJun 5, 2011
  6. Jakub NarebskiJun 5, 2011
  7. Matt McCutchenJun 5, 2011
  8. Jakub NarebskiJun 8, 2011
  9. J.H.Jun 8, 2011
  10. gitweb: Make $prevent_xss protection for 'blob_plain' more usableJakub Narebski, Jun 10, 2011
  11. Junio C HamanoJun 13, 2011
  12. Jakub NarebskiJun 13, 2011
  13. Junio C HamanoJun 13, 2011
  14. Jakub NarebskiJun 14, 2011

Read the whole thread, see it on lore, or plain text.

$ cat FOOTERMessages come from the public archive at lore.kernel.org/git, fetched every hour. The front page is chosen and written each morning by an AI editor and can be wrong; the threads themselves are the record. About and API. For agents: an MCP server at https://gitlist.dev/mcp, and any thread, story or person page as Markdown by adding .md to its URL (or sending Accept: text/markdown). Details in /llms.txt.