- Issue created by @prudloff
- 🇫🇷France prudloff Lille
An alternative solution would be to add this to security_review: ✨ Check for CSP on private and public SVG files Active
This is a followup to
#2868079: Add a default Content-Security-Policy-header for svg files →
.
This issue adds a CSP header for SVG files.
It would be useful to have a check in the status report that makes sure this CSP is added correctly.
However, this has some challenges:
We can't always guarantee this, especially when running the checks in a CLI environment.
Some work was started here: https://git.drupalcode.org/project/drupal/-/blob/a70fae35ca4f0a09a5e5665...
Postponed
11.0 🔥
other
It makes Drupal less vulnerable to abuse or misuse. Note, this is the preferred tag, though the Security tag has a large body of issues tagged to it. Do NOT publicly disclose security vulnerabilities; contact the security team instead. Anyone (whether security team or not) can apply this tag to security improvements that do not directly present a vulnerability e.g. hardening an API to add filtering to reduce a common mistake in contributed modules.
An alternative solution would be to add this to security_review: ✨ Check for CSP on private and public SVG files Active