From ad8f30cb09ea2295fc9163915d2171b74b261e32 Mon Sep 17 00:00:00 2001
From: fs <fs@breadcrumb-solutions.de>
Date: Fri, 13 Mar 2026 19:24:10 +0100
Subject: [PATCH] feat(security): add Content-Security-Policy headers with
 strict script-src

Eliminate all inline scripts to enable script-src 'self' without
'unsafe-inline', providing strong XSS mitigation via CSP.

Inline script removal:
- login.phtml: replace inline APP_ASSET_BASE with data-asset-base
  attribute + app-boot.js (matching default.phtml pattern)
- api-docs: extract SwaggerUI init to js/pages/admin-api-docs-index.js
- docs: extract checkbox enablement to js/pages/admin-docs-index.js
- language-switcher: replace onchange handler with data-auto-submit
  attribute + js/components/app-auto-submit.js event listener

CSP policy (dev + prod nginx):
  default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline';
  img-src 'self' data:; font-src 'self'; connect-src 'self';
  form-action 'self'; base-uri 'self'; frame-ancestors 'none';
  manifest-src 'self'

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
---
 docker/nginx/default.conf                     |  1 +
 docker/nginx/prod.conf                        |  2 ++
 pages/admin/api-docs/index(default).phtml     | 25 ++-----------------
 pages/admin/docs/index(default).phtml         |  8 +-----
 templates/login.phtml                         |  5 ++--
 .../partials/app-language-switcher.phtml      |  2 +-
 web/js/app-init.js                            |  1 +
 web/js/components/app-auto-submit.js          | 12 +++++++++
 web/js/pages/admin-api-docs-index.js          | 16 ++++++++++++
 web/js/pages/admin-docs-index.js              |  3 +++
 10 files changed, 41 insertions(+), 34 deletions(-)
 create mode 100644 web/js/components/app-auto-submit.js
 create mode 100644 web/js/pages/admin-api-docs-index.js
 create mode 100644 web/js/pages/admin-docs-index.js

diff --git a/docker/nginx/default.conf b/docker/nginx/default.conf
index ca71e9e..1cf386a 100644
--- a/docker/nginx/default.conf
+++ b/docker/nginx/default.conf
@@ -9,6 +9,7 @@ server {
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
     add_header X-Permitted-Cross-Domain-Policies "none" always;
+    add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; manifest-src 'self';" always;
 
     root /var/www/web;
     index index.php;
diff --git a/docker/nginx/prod.conf b/docker/nginx/prod.conf
index 26c7486..de3ab0a 100644
--- a/docker/nginx/prod.conf
+++ b/docker/nginx/prod.conf
@@ -7,6 +7,7 @@ server {
     add_header Referrer-Policy "strict-origin-when-cross-origin" always;
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
     add_header X-Permitted-Cross-Domain-Policies "none" always;
+    add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; manifest-src 'self'; upgrade-insecure-requests;" always;
 
     return 301 https://$host$request_uri;
 }
@@ -30,6 +31,7 @@ server {
     add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=(), usb=()" always;
     add_header X-Permitted-Cross-Domain-Policies "none" always;
     add_header Strict-Transport-Security "max-age=31536000" always;
+    add_header Content-Security-Policy "default-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data:; font-src 'self'; connect-src 'self'; form-action 'self'; base-uri 'self'; frame-ancestors 'none'; manifest-src 'self'; upgrade-insecure-requests;" always;
 
     root /var/www/web;
     index index.php;
diff --git a/pages/admin/api-docs/index(default).phtml b/pages/admin/api-docs/index(default).phtml
index 743a2e0..758fd2e 100644
--- a/pages/admin/api-docs/index(default).phtml
+++ b/pages/admin/api-docs/index(default).phtml
@@ -8,29 +8,8 @@ require templatePath('partials/app-breadcrumb.phtml');
 ?>
 
 <div class="app-swagger-container">
-  <div id="swagger-ui"></div>
+  <div id="swagger-ui" data-spec-url="<?php e($specUrl); ?>"></div>
 </div>
 
 <script src="<?php e(assetVersion('vendor/swagger-ui/swagger-ui-bundle.js')); ?>"></script>
-<script>
-  window.addEventListener('DOMContentLoaded', function () {
-    if (!window.SwaggerUIBundle) {
-      return;
-    }
-
-    window.SwaggerUIBundle({
-      url: '<?php e($specUrl); ?>',
-      dom_id: '#swagger-ui',
-      deepLinking: false,
-      displayRequestDuration: true,
-      filter: true,
-      docExpansion: 'list',
-      supportedSubmitMethods: [],
-      tryItOutEnabled: false,
-      presets: [
-        window.SwaggerUIBundle.presets.apis,
-      ],
-      layout: 'BaseLayout'
-    });
-  });
-</script>
+<script type="module" src="<?php e(assetVersion('js/pages/admin-api-docs-index.js')); ?>"></script>
diff --git a/pages/admin/docs/index(default).phtml b/pages/admin/docs/index(default).phtml
index 63cb26c..a1df697 100644
--- a/pages/admin/docs/index(default).phtml
+++ b/pages/admin/docs/index(default).phtml
@@ -70,10 +70,4 @@
 
 </div>
 
-<script>
-  window.addEventListener('DOMContentLoaded', function () {
-    document.querySelectorAll('.app-docs-content li > input[type="checkbox"][disabled]').forEach(function (checkbox) {
-      checkbox.removeAttribute('disabled');
-    });
-  });
-</script>
+<script type="module" src="<?php e(assetVersion('js/pages/admin-docs-index.js')); ?>"></script>
diff --git a/templates/login.phtml b/templates/login.phtml
index 3356437..550fa40 100644
--- a/templates/login.phtml
+++ b/templates/login.phtml
@@ -17,15 +17,14 @@ if ($bufferTitle !== '') {
 <!DOCTYPE html>
 <html
   data-theme="<?php e($theme); ?>"
+  data-asset-base="<?php e(asset('')); ?>"
   data-password-toggle-show-label="<?php e(t('Show password')); ?>"
   data-password-toggle-hide-label="<?php e(t('Hide password')); ?>"
   <?php if ($primaryVars !== ''): ?>style="<?php e($primaryVars); ?>" <?php endif; ?>>
 
 <head>
+  <script src="<?php e(assetVersion('js/app-boot.js')); ?>"></script>
   <base href="<?php e(localeBase()); ?>">
-  <script>
-    window.APP_ASSET_BASE = "<?php e(asset('')); ?>";
-  </script>
   <title><?php e($pageTitle); ?></title>
   <meta property="og:site_name" content="<?php e($defaultTitle); ?>">
   <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
diff --git a/templates/partials/app-language-switcher.phtml b/templates/partials/app-language-switcher.phtml
index 9abf713..f92c32f 100644
--- a/templates/partials/app-language-switcher.phtml
+++ b/templates/partials/app-language-switcher.phtml
@@ -44,7 +44,7 @@ $publicTarget = ltrim($publicTarget, '/');
     <?php if ($isLoggedIn): ?>
         <form class="nav nav--lang" method="get" action="<?php e($baseUrl); ?>" aria-label="<?php e(t('Language switcher')); ?>">
             <input type="hidden" name="return" value="<?php e($returnTarget); ?>">
-            <select class="lang-select" name="locale" onchange="this.form.submit()">
+            <select class="lang-select" name="locale" data-auto-submit>
                 <?php foreach ($locales as $locale): ?>
                     <option value="<?php e($locale); ?>" <?php if ($locale === I18n::$locale) { ?>selected<?php } ?>>
                         <?php e(strtoupper((string) $locale)); ?>
diff --git a/web/js/app-init.js b/web/js/app-init.js
index ed5aac2..7768a5b 100644
--- a/web/js/app-init.js
+++ b/web/js/app-init.js
@@ -22,3 +22,4 @@ import './components/app-custom-field-options-toggle.js';
 import './components/app-tenant-sso-toggle.js';
 import './components/app-settings-telemetry.js';
 import './components/app-standard-detail-page.js';
+import './components/app-auto-submit.js';
diff --git a/web/js/components/app-auto-submit.js b/web/js/components/app-auto-submit.js
new file mode 100644
index 0000000..6898d0a
--- /dev/null
+++ b/web/js/components/app-auto-submit.js
@@ -0,0 +1,12 @@
+/**
+ * Auto-submit: submits the parent form when a [data-auto-submit] element changes.
+ * Replaces inline onchange="this.form.submit()" handlers for CSP compliance.
+ */
+document.querySelectorAll('[data-auto-submit]').forEach((element) => {
+  element.addEventListener('change', () => {
+    const form = element.closest('form');
+    if (form) {
+      form.submit();
+    }
+  });
+});
diff --git a/web/js/pages/admin-api-docs-index.js b/web/js/pages/admin-api-docs-index.js
new file mode 100644
index 0000000..764d5b4
--- /dev/null
+++ b/web/js/pages/admin-api-docs-index.js
@@ -0,0 +1,16 @@
+const container = document.getElementById('swagger-ui');
+
+if (container && window.SwaggerUIBundle) {
+  window.SwaggerUIBundle({
+    url: container.dataset.specUrl || '',
+    dom_id: '#swagger-ui',
+    deepLinking: false,
+    displayRequestDuration: true,
+    filter: true,
+    docExpansion: 'list',
+    supportedSubmitMethods: [],
+    tryItOutEnabled: false,
+    presets: [window.SwaggerUIBundle.presets.apis],
+    layout: 'BaseLayout',
+  });
+}
diff --git a/web/js/pages/admin-docs-index.js b/web/js/pages/admin-docs-index.js
new file mode 100644
index 0000000..387b9af
--- /dev/null
+++ b/web/js/pages/admin-docs-index.js
@@ -0,0 +1,3 @@
+document
+  .querySelectorAll('.app-docs-content li > input[type="checkbox"][disabled]')
+  .forEach((checkbox) => checkbox.removeAttribute('disabled'));