AcadeNice/corentin_wakdo
9
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat(borne): CSP stricte same-origin + replis d'image CSP-safe #123

Merged
Corentin merged 1 commit from feat/csp-borne into dev 2026-07-02 13:47:57 +02:00
Conversation 0 Commits 1 Files changed 9 +172 -5
Corentin commented 2026-07-02 13:44:39 +02:00
Owner
Copy link
No description provided.
feat(borne): CSP stricte same-origin + replis d'image sans handler inline
All checks were successful
CI / secret-scan (pull_request) Successful in 20s
Details
CI / php-lint (pull_request) Successful in 42s
Details
CI / static-tests (pull_request) Successful in 1m25s
Details
CI / js-tests (pull_request) Successful in 41s
Details
CI / secret-scan (push) Successful in 21s
Details
CI / php-lint (push) Successful in 38s
Details
CI / static-tests (push) Successful in 1m26s
Details
CI / js-tests (push) Successful in 46s
Details
7ee0792036 
Le vhost borne n'avait aucun en-tete Content-Security-Policy (seul l'admin en
avait un). Ajout d'une CSP STRICTE sur le vhost kiosk : default-src 'self',
script-src 'self' et style-src 'self' SANS 'unsafe-inline', + frame-ancestors
'none', object-src 'none', base-uri 'self', form-action 'self'. HSTS + nosniff
en complement. La borne ne charge que du same-origin (scripts, styles, polices,
images auto-heberges, aucun CDN), donc rien a assouplir.

Pour que script-src 'self' n'ait rien a bloquer, les elements inline ont ete
retires :
- 4 handlers onerror="..." inline (cartes produit, bandeau categories, options
  produit, composeur menu) -> un unique listener delegue en capture
  (assets/js/img-fallback.js) ; les <img> declarent leur repli via data-fallback
  ("logo" ou "hide"). Le masquage passe par une classe, pas un style inline.
- 1 style="width:80px" inline (spacer d'en-tete categories) -> classe
  .site-header__spacer.

Verifie : 160 tests JS verts (dont 9 pour img-fallback) ; en-tete CSP servie et
Apache OK sur une image reconstruite ; 0 violation CSP en console sur accueil /
categories / produits (Playwright).

Note deploiement : vhost.conf est COPYe dans l'image wakdo-web -> la CSP devient
active seulement apres reconstruction + recreation du conteneur wakdo-web.
Corentin scheduled this pull request to auto merge when all checks succeed 2026-07-02 13:44:43 +02:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
auto-merge
Fusion automatique sur CI verte

No labels
auto-merge
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
AcadeNice/corentin_wakdo!123
No description provided.