chore(api,docs): use strict CSPs for docs Web UI

leonklingele · leonklingele · commit 03bdd0b2e392 · 2025-11-17T18:03:00.000+01:00
diff --git a/api.go b/api.go
@@ -477,6 +477,17 @@ func NewAPI(config Config, a Adapter) API {
 				openAPIPath = path.Join(prefix, openAPIPath)
 			}
 			ctx.SetHeader("Content-Type", "text/html")
+			// Very strict CSP so we never expose any data to the outside world
+			ctx.SetHeader("Content-Security-Policy",
+				"default-src 'none';"+
+					" base-uri 'none';"+
+					" connect-src 'self';"+
+					" form-action 'none';"+
+					" frame-ancestors 'none';"+
+					" sandbox allow-same-origin allow-scripts;"+
+					" script-src https://unpkg.com/;"+
+					" style-src 'unsafe-inline' https://unpkg.com/;"+
+					" trusted-types 'none'")
 			title := "Elements in HTML"
 			if config.Info != nil && config.Info.Title != "" {
 				title = config.Info.Title + " Reference"
diff --git a/docs/docs/features/api-docs.md b/docs/docs/features/api-docs.md
@@ -31,6 +31,17 @@ api := humachi.New(router, config)
 
 router.Get("/docs", func(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html")
+	// Very strict CSP so we never expose any data to the outside world
+	w.Header().Set("Content-Security-Policy",
+		"default-src 'none';"+
+			" base-uri 'none';"+
+			" connect-src 'self';"+
+			" form-action 'none';"+
+			" frame-ancestors 'none';"+
+			" sandbox allow-same-origin allow-scripts;"+
+			" script-src https://unpkg.com/;"+
+			" style-src 'unsafe-inline' https://unpkg.com/;"+
+			" trusted-types 'none'")
 	w.Write([]byte(`<!doctype html>
 <html lang="en">
   <head>
@@ -67,6 +78,17 @@ api := humachi.New(router, config)
 
 router.Get("/docs", func(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html")
+	// Very strict CSP so we never expose any data to the outside world
+	w.Header().Set("Content-Security-Policy",
+		"default-src 'none';"+
+			" base-uri 'none';"+
+			" connect-src 'self';"+
+			" form-action 'none';"+
+			" frame-ancestors 'none';"+
+			" sandbox allow-same-origin allow-scripts;"+
+			" script-src 'unsafe-eval' https://unpkg.com/;"+ // TODO: Somehow drop 'unsafe-eval'
+			" style-src 'unsafe-inline' https://unpkg.com/;"+ // TODO: Somehow drop 'unsafe-inline'
+			" trusted-types 'none'")
 	w.Write([]byte(`<!doctype html>
 <html>
   <head>
@@ -101,6 +123,17 @@ api := humachi.New(router, config)
 
 router.Get("/docs", func(w http.ResponseWriter, r *http.Request) {
 	w.Header().Set("Content-Type", "text/html")
+	// Very strict CSP so we never expose any data to the outside world
+	w.Header().Set("Content-Security-Policy",
+		"default-src 'none';"+
+			" base-uri 'none';"+
+			" connect-src 'self';"+
+			" form-action 'none';"+
+			" frame-ancestors 'none';"+
+			" sandbox allow-same-origin allow-scripts;"+
+			" script-src https://unpkg.com/ 'sha256-SWB2p1nUb0MJzt5MoVlrz+PWYxv53T2z7GdKFxZm9i4=';"+
+			" style-src https://unpkg.com/;"+
+			" trusted-types 'none'")
 	w.Write([]byte(`<!DOCTYPE html>
 <html lang="en">
 <head>
