jesse-a/OpenCRM
1
0
Fork 0
Code Issues 1 Pull requests Projects Releases 1 Packages Wiki Activity Actions

CSP img-src + connect-src accepteerde alle https:// #121

New issue
Closed
opened 2026-05-26 18:23:49 +00:00 by jesse-a · 1 comment
jesse-a commented 2026-05-26 18:23:49 +00:00
Owner
Copy link

Severity: LOW (internet.nl-bevinding #9)

CSP had img-src 'self' data: blob: https: en connect-src 'self' https: — het losse https:-schema staat álle externe https-bronnen toe. internet.nl markeert dat als "onvoldoende beperkend".

Fix: losse https:-schema's verwijderd; alleen 'self' + data: + blob: toegestaan. Geverifieerd dat de app geen externe fetch, <img> of next/image doet — alle externe diensten (KVK, Mollie, DocuSeal) lopen server-side via /api.

**Severity: LOW** (internet.nl-bevinding #9) CSP had `img-src 'self' data: blob: https:` en `connect-src 'self' https:` — het losse `https:`-schema staat álle externe https-bronnen toe. internet.nl markeert dat als "onvoldoende beperkend". **Fix**: losse `https:`-schema's verwijderd; alleen `'self'` + `data:` + `blob:` toegestaan. Geverifieerd dat de app geen externe `fetch`, `<img>` of `next/image` doet — alle externe diensten (KVK, Mollie, DocuSeal) lopen server-side via /api.
jesse-a commented 2026-05-26 18:23:50 +00:00
Author
Owner
Copy link

Opgelost in commit bd45604.

Opgelost in commit bd45604.
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
main
v1.0.0
v0.11
v0.10
v0.9
v0.8
v0.7
v0.6
v0.5
Labels
Clear labels   
deferred
Known issue, deferred

  
fixed
Resolved

  
security
Security review finding

  
severity-high
High severity

  
severity-low
Low severity

  
severity-medium
Medium severity

No labels
deferred
fixed
security
severity-high
severity-low
severity-medium
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
jesse-a/OpenCRM#121
No description provided.