You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@tooling.apache.org by "andrewmusselman (via GitHub)" <gi...@apache.org> on 2026/02/25 19:13:45 UTC
[I] Add CSP sandbox directive for directory listing responses (tooling-trusted-releases)
andrewmusselman opened a new issue, #793:
URL: https://github.com/apache/tooling-trusted-releases/issues/793
**ASVS:** 3.2.1 · **CWE:** CWE-1021 · **Files:** `atr/get/download.py` (lines 166–192), `atr/get/published.py` (lines 56–85)
### Description
Directory listing endpoints generate HTML incorporating file and directory names. The global CSP provides good protection (`frame-src: 'none'`, `object-src: 'none'`), but does not include a `sandbox` directive, which ASVS 3.2.1 recommends for preventing script execution in dynamically served content.
### Recommended fix
Consider adding a stricter CSP for directory listing responses:
```python
response = web.ElementResponse(response_body)
response.headers['Content-Security-Policy'] = "sandbox; default-src 'self'"
return response
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Add CSP sandbox directive for directory listing responses (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #793:
URL: https://github.com/apache/tooling-trusted-releases/issues/793#issuecomment-3987014783
See #805
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Add CSP sandbox directive for directory listing responses (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave closed issue #793: Add CSP sandbox directive for directory listing responses
URL: https://github.com/apache/tooling-trusted-releases/issues/793
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Add CSP sandbox directive for directory listing responses (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #793:
URL: https://github.com/apache/tooling-trusted-releases/issues/793#issuecomment-3986999760
I took a different approach and protected are apache configured download area in bf14abb8216c49835bf2fe9e790f88a456566c9e
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org
Re: [I] Add CSP sandbox directive for directory listing responses (tooling-trusted-releases)
Posted by "dave2wave (via GitHub)" <gi...@apache.org>.
dave2wave commented on issue #793:
URL: https://github.com/apache/tooling-trusted-releases/issues/793#issuecomment-3987007940
`published.py` is a debugging endpoint which needs to be reworked.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@tooling.apache.org
For additional commands, e-mail: dev-help@tooling.apache.org