Skip to content
This repository has been archived by the owner on Apr 26, 2024. It is now read-only.

Mitigate media repo XSSs on IE11. #10468

Merged
merged 2 commits into from
Jul 27, 2021
Merged

Mitigate media repo XSSs on IE11. #10468

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a5639bf
Mitigate media repo XSSs on IE11.
dkasak Jul 23, 2021
c7a1ae2
Add changelog entry.
dkasak Jul 23, 2021
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions changelog.d/10468.misc
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
Mitigate media repo XSS attacks on IE11 via the non-standard X-Content-Security-Policy header.
2 changes: 2 additions & 0 deletions synapse/rest/media/v1/download_resource.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,8 @@ async def _async_render_GET(self, request: Request) -> None:
b" media-src 'self';"
b" object-src 'self';",
)
# Limited non-standard form of CSP for IE11
request.setHeader(b"X-Content-Security-Policy", b"sandbox;")
request.setHeader(
b"Referrer-Policy",
b"no-referrer",
Expand Down