fix(webapp): add CSP_OBJECT_SRC for PDF blob preview #464
Conversation
- Add CSP_OBJECT_SRC env var to allow 'self' blob: for PDF preview - Update security-headers.conf.template with configurable object-src - Update docker-entrypoint.sh to validate and substitute CSP_OBJECT_SRC - Update Dockerfile with default CSP_OBJECT_SRC="'self' blob:" - Document in .env.example Fixes: CSP 'object-src none' blocking PDF preview using <object> tag with blob URLs created by URL.createObjectURL()
github-actions
bot
added
the
area:frontend:web
📝 WalkthroughSummary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings. WalkthroughThis PR introduces the Changes
Estimated Code Review Effort🎯 1 (Trivial) | ⏱️ ~5 minutes Possibly related PRs
Suggested labels
Suggested reviewers
Poem
Pre-merge checks and finishing touches❌ Failed checks (1 warning)
✅ Passed checks (5 passed)
✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.Scanned FilesNone |
|
Deploying cvix with
|
| Latest commit: |
fbd3ecf
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://52401f6a.cvix.pages.dev |
| Branch Preview URL: | https://fix-csp-object-src.cvix.pages.dev |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
📜 Review details
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: ASSERTIVE
Plan: Pro
Disabled knowledge base sources:
- Linear integration is disabled by default for public repositories
You can enable these sources in your CodeRabbit configuration.
📒 Files selected for processing (4)
.env.exampleclient/apps/webapp/Dockerfileclient/apps/webapp/docker-entrypoint.shclient/apps/webapp/security-headers.conf.template
🧰 Additional context used
🧠 Learnings (1)
📚 Learning: 2025-12-20T14:56:41.648Z
Learnt from: CR
Repo: dallay/cvix PR: 0
File: .ruler/frontend/html-css.md:0-0
Timestamp: 2025-12-20T14:56:41.648Z
Learning: Implement Content Security Policy (CSP) headers to mitigate XSS and other content injection attacks
Applied to files:
.env.exampleclient/apps/webapp/security-headers.conf.template
🪛 dotenv-linter (4.0.0)
.env.example
[warning] 99-99: [UnorderedKey] The CSP_CONNECT_SRC key should go before the CSP_SCRIPT_SRC key
(UnorderedKey)
[warning] 100-100: [UnorderedKey] The CSP_OBJECT_SRC key should go before the CSP_SCRIPT_SRC key
(UnorderedKey)
⏰ Context from checks skipped due to timeout of 90000ms. You can increase the timeout in your CodeRabbit configuration to a maximum of 15 minutes (900000ms). (8)
- GitHub Check: 🎭 E2E Tests (Playwright) (chromium)
- GitHub Check: 🎭 E2E Tests (Playwright) (webkit)
- GitHub Check: 🎭 E2E Tests (Playwright) (firefox)
- GitHub Check: Frontend Build & Test
- GitHub Check: Analyze (javascript-typescript)
- GitHub Check: qodana
- GitHub Check: Analyze (java-kotlin)
- GitHub Check: Cloudflare Pages
🔇 Additional comments (7)
client/apps/webapp/Dockerfile (1)
88-93: LGTM with security advisory.The CSP_OBJECT_SRC environment variable is properly configured with sensible defaults. The comment clearly documents both the permissive default and the strict alternative.
Security consideration: The default
'self' blob:enables blob URLs, which allow the application to create object URLs from arbitrary data. Ensure that:
- Blob URL creation in your PDF preview logic validates and sanitizes all input
- Only trusted, application-generated PDFs are rendered via blob URLs
- User-uploaded content rendered as blobs could enable data exfiltration or content injection
If PDF preview functionality isn't needed in all environments, consider setting
CSP_OBJECT_SRC="'none'"in production and enabling blob: only where required.Based on learnings, this aligns with implementing Content Security Policy headers to mitigate XSS and content injection attacks.
client/apps/webapp/security-headers.conf.template (2)
9-10: Clear documentation for CSP_OBJECT_SRC usage.The template comments effectively document the purpose and security implications of the CSP_OBJECT_SRC directive, providing both permissive and strict examples.
Based on learnings, this aligns with implementing Content Security Policy headers to mitigate XSS and content injection attacks.
15-15: Proper variable substitution for object-src directive.The Content-Security-Policy header correctly uses
${CSP_OBJECT_SRC}for runtime substitution, maintaining consistency with other CSP directives (script-src, style-src, connect-src).client/apps/webapp/docker-entrypoint.sh (4)
28-28: Proper validation for CSP_OBJECT_SRC.The pre-check correctly validates that CSP_OBJECT_SRC is set, maintaining consistency with other required CSP environment variables.
38-38: Clear error guidance for CSP_OBJECT_SRC.The error message provides helpful context including the example value
'self' blob: for PDF preview, making it easy for operators to understand the purpose and configure correctly.
49-49: CSP_OBJECT_SRC included in environment summary.The environment variable is properly logged during startup, aiding in troubleshooting and verification.
52-53: Complete envsubst configuration.CSP_OBJECT_SRC is correctly included in both envsubst invocations, ensuring the variable is substituted in both
nginx.conf.templateandsecurity-headers.conf.template. This completes the configuration chain from environment variable to runtime configuration.
| # CSP_OBJECT_SRC: Allowed sources for <object>, <embed>, <applet> elements. | ||
| # Use 'self' blob: to allow PDF preview with blob URLs, or 'none' for strict security. | ||
| CSP_SCRIPT_SRC="'self' 'unsafe-inline'" | ||
| CSP_STYLE_SRC="'self' 'unsafe-inline'" | ||
| CSP_CONNECT_SRC="'self' https://api.example.com https://auth.example.com" | ||
| CSP_OBJECT_SRC="'self' blob:" |
There was a problem hiding this comment.
🧹 Nitpick | 🔵 Trivial
Well-documented CSP_OBJECT_SRC configuration.
The documentation clearly explains the purpose of CSP_OBJECT_SRC, providing context for both the permissive default ('self' blob:) for PDF previews and the strict alternative ('none').
The static analysis warning about key ordering is purely cosmetic. If you want to maintain alphabetical ordering for easier scanning, consider reordering the CSP variables alphabetically:
🔎 Optional style improvement
CSP_SCRIPT_SRC="'self' 'unsafe-inline'"
CSP_STYLE_SRC="'self' 'unsafe-inline'"
-CSP_CONNECT_SRC="'self' https://api.example.com https://auth.example.com"
-CSP_OBJECT_SRC="'self' blob:"
+CSP_CONNECT_SRC="'self' https://api.example.com https://auth.example.com"
+CSP_OBJECT_SRC="'self' blob:"However, the current grouping (keeping related CSP directives together) is also reasonable and may be more intuitive than strict alphabetization.
Committable suggestion skipped: line range outside the PR's diff.
🧰 Tools
🪛 dotenv-linter (4.0.0)
[warning] 99-99: [UnorderedKey] The CSP_CONNECT_SRC key should go before the CSP_SCRIPT_SRC key
(UnorderedKey)
[warning] 100-100: [UnorderedKey] The CSP_OBJECT_SRC key should go before the CSP_SCRIPT_SRC key
(UnorderedKey)
🤖 Prompt for AI Agents
.env.example lines 95-100: static analysis flagged CSP key ordering as a
cosmetic issue; to satisfy the linter, reorder the CSP_* variables
alphabetically (e.g., CSP_CONNECT_SRC, CSP_OBJECT_SRC, CSP_SCRIPT_SRC,
CSP_STYLE_SRC) while keeping the existing values and comments unchanged.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #464 +/- ##
=======================================
Coverage 77.32% 77.32%
=======================================
Files 90 90
Lines 3370 3370
Branches 894 893 -1
=======================================
Hits 2606 2606
Misses 674 674
Partials 90 90
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Qodana for JVM77 new problems were found
☁️ View the detailed Qodana report Contact Qodana teamContact us at [email protected]
|
Summary
CSP_OBJECT_SRCenvironment variable to allow'self' blob:for PDF previewobject-src 'none'directive blocking PDF preview using<object>tag with blob URLsProblem
The PDF preview in the Resume Generator page uses
<object type="application/pdf">with a blob URL created byURL.createObjectURL(). The previous CSP policy hadobject-src 'none'which blocked this.Solution
Make
object-srcconfigurable viaCSP_OBJECT_SRCenvironment variable, defaulting to'self' blob:to allow PDF blob URLs while maintaining security.Changes
security-headers.conf.template: Use${CSP_OBJECT_SRC}instead of hardcoded'none'docker-entrypoint.sh: Validate and substituteCSP_OBJECT_SRCDockerfile: Add defaultCSP_OBJECT_SRC="'self' blob:".env.example: Document the new variableDeployment
After merging, set in Dokploy: