[PR #80] [MERGED] Security headers #149

New issue

Closed

opened 2026-02-27 10:15:57 +03:00 by kerem · 0 comments

kerem commented

2026-02-27 10:15:57 +03:00

Owner

📋 Pull Request Information

Original PR: https://github.com/matze/wastebin/pull/80
Author: @cgzones
Created: 11/12/2024
Status: ✅ Merged
Merged: 1/11/2025
Merged by: @matze

Base: master ← Head: security_headers

📝 Commits (2)

921324e Avoid inline styles and scripts
a705a4a Add security headers

📊 Changes

11 files changed (+224 additions, -110 deletions)

View changed files

📝 src/env.rs (+2 -1)
📝 src/highlight.rs (+17 -0)
➕ src/javascript/index.js (+69 -0)
➕ src/javascript/paste.js (+44 -0)
📝 src/main.rs (+42 -1)
📝 src/routes/assets.rs (+17 -0)
📝 src/themes/style.css (+17 -0)
📝 templates/base.html (+1 -0)
📝 templates/encrypted.html (+4 -4)
📝 templates/index.html (+5 -63)
📝 templates/paste.html (+6 -41)

📄 Description

Modern browser support security headers, in particular Content Security
Policy (CSP)(https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP).
These can help mitigating XSS vulnerabilities, in the case of pastes by
disallowing inline styles and scripts.

Move all current inline styles into the global style.css, and refactor
all inline javascript into separate asset files.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/matze/wastebin/pull/80 **Author:** [@cgzones](https://github.com/cgzones) **Created:** 11/12/2024 **Status:** ✅ Merged **Merged:** 1/11/2025 **Merged by:** [@matze](https://github.com/matze) **Base:** `master` ← **Head:** `security_headers` --- ### 📝 Commits (2) - [`921324e`](https://github.com/matze/wastebin/commit/921324e15f3d9a32e0e2aaa9efbe610010afd389) Avoid inline styles and scripts - [`a705a4a`](https://github.com/matze/wastebin/commit/a705a4a44c23ae99e8bc34f03f043ca10181dc7a) Add security headers ### 📊 Changes **11 files changed** (+224 additions, -110 deletions) <details> <summary>View changed files</summary> 📝 `src/env.rs` (+2 -1) 📝 `src/highlight.rs` (+17 -0) ➕ `src/javascript/index.js` (+69 -0) ➕ `src/javascript/paste.js` (+44 -0) 📝 `src/main.rs` (+42 -1) 📝 `src/routes/assets.rs` (+17 -0) 📝 `src/themes/style.css` (+17 -0) 📝 `templates/base.html` (+1 -0) 📝 `templates/encrypted.html` (+4 -4) 📝 `templates/index.html` (+5 -63) 📝 `templates/paste.html` (+6 -41) </details> ### 📄 Description Modern browser support security headers, in particular Content Security Policy (CSP)(https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP). These can help mitigating XSS vulnerabilities, in the case of pastes by disallowing inline styles and scripts. Move all current inline styles into the global style.css, and refactor all inline javascript into separate asset files. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>