fix(security): add base-uri 'self' + object-src 'none' to the admin CSP (CoreBunch#158)

DavidBabinec · claude · web-flow · commit ae7ed0dc0234 · 2026-07-03T15:56:52.000+02:00
The admin CSP was `frame-ancestors 'none'` only. Add two directives that are
safe to enforce today and close two injection vectors as defense-in-depth
behind the htmlAttributes/custom-tag hardening:

- `base-uri 'self'` — a `&lt;base href&gt;` injection can otherwise rewrite the
  resolution of every relative URL on the page (script/style/fetch targets).
  The admin never emits a `&lt;base&gt;` element.
- `object-src 'none'` — blocks `&lt;object&gt;` / `&lt;embed&gt;` plugin content. The
  admin never embeds either.

A `script-src` / `style-src` policy is deliberately still NOT set: the admin
ships an inline `&lt;script type="importmap"&gt;` the plugin runtime needs, the
visual-editor canvas is `srcDoc` iframes (which inherit this policy) that
inject the site's runtime scripts as inline `&lt;script&gt;`, and the editor relies
on inline styles for dynamic custom properties. A safe `script-src` needs
per-request nonce plumbing through the served-HTML patcher and the canvas
script injector plus a full editor browser sweep — a dedicated follow-up.

Tests: security-headers.test.ts updated to assert the three-directive policy
on every /admin path and the absence on public/uploads/root.

Co-authored-by: Claude Fable 5 &lt;noreply@anthropic.com&gt;
diff --git a/server/securityHeaders.ts b/server/securityHeaders.ts
@@ -22,14 +22,23 @@ import { publicOriginIsHttps } from './auth/security'
  *
  * Admin-specific headers (pathname starts with /admin):
  *   - `X-Frame-Options: DENY` — blocks framing in legacy browsers.
- *   - `Content-Security-Policy: frame-ancestors 'none'` — blocks framing in
- *     modern browsers. Sent alongside X-Frame-Options because frame-ancestors
- *     takes precedence where supported.
+ *   - `Content-Security-Policy` — three directives that are safe today:
+ *       · `frame-ancestors 'none'` — blocks framing in modern browsers (sent
+ *         alongside X-Frame-Options, which it supersedes where supported).
+ *       · `base-uri 'self'` — blocks a `<base href>` injection from rewriting
+ *         the resolution of every relative URL on the page (the admin never
+ *         emits a `<base>` element).
+ *       · `object-src 'none'` — blocks `<object>` / `<embed>` plugin content
+ *         (the admin never embeds either).
  *
- *   A full admin CSP (default-src, script-src, etc.) is a follow-up task.
- *   The admin is a React SPA with a blob: canvas iframe and dynamically-loaded
- *   plugin module bundles; scoping beyond frame-ancestors requires auditing
- *   every source to avoid breaking the editor.
+ *   A `script-src` / `style-src` policy is deliberately NOT set here yet: the
+ *   admin ships an inline `<script type="importmap">` the plugin runtime needs,
+ *   the visual-editor canvas is `srcDoc` iframes (which inherit this policy)
+ *   that inject the site's runtime scripts as inline `<script>`, and the
+ *   editor relies on inline styles for dynamic custom properties. A safe
+ *   `script-src` therefore requires per-request nonce plumbing through the
+ *   served-HTML patcher and the canvas script injector plus a full editor
+ *   browser sweep — tracked as a dedicated follow-up, not bolted on here.
  *
  * @param res      The raw Response from the route handler.
  * @param pathname URL pathname of the incoming request.
@@ -57,7 +66,10 @@ export function applySecurityHeaders(res: Response, pathname: string): Response
   // A framed CMS admin is a clickjacking vector for one-click publish/delete.
   if (pathname.startsWith('/admin')) {
     headers.set('x-frame-options', 'DENY')
-    headers.set('content-security-policy', "frame-ancestors 'none'")
+    headers.set(
+      'content-security-policy',
+      "frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+    )
   }
 
   return new Response(res.body, {
diff --git a/src/__tests__/server/security-headers.test.ts b/src/__tests__/server/security-headers.test.ts
@@ -96,21 +96,37 @@ describe('applySecurityHeaders — admin framing protection', () => {
     expect(res.headers.get('x-frame-options')).toBe('DENY')
   })
 
-  it("sets CSP frame-ancestors 'none' on /admin HTML responses", () => {
+  it('sets the admin CSP (frame-ancestors + base-uri + object-src) on /admin HTML responses', () => {
     const res = applySecurityHeaders(makeResponse('<html>admin</html>'), '/admin')
-    expect(res.headers.get('content-security-policy')).toBe("frame-ancestors 'none'")
+    expect(res.headers.get('content-security-policy')).toBe(
+      "frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+    )
   })
 
-  it('applies framing protection to /admin/* subpaths (admin SPA routes)', () => {
+  it("locks base-uri to 'self' so a <base href> injection can't rewrite relative URLs", () => {
+    const res = applySecurityHeaders(makeResponse('<html>admin</html>'), '/admin')
+    expect(res.headers.get('content-security-policy')).toContain("base-uri 'self'")
+  })
+
+  it("blocks <object>/<embed> plugin content with object-src 'none'", () => {
+    const res = applySecurityHeaders(makeResponse('<html>admin</html>'), '/admin')
+    expect(res.headers.get('content-security-policy')).toContain("object-src 'none'")
+  })
+
+  it('applies the admin CSP to /admin/* subpaths (admin SPA routes)', () => {
     const res = applySecurityHeaders(makeResponse(), '/admin/site/123')
     expect(res.headers.get('x-frame-options')).toBe('DENY')
-    expect(res.headers.get('content-security-policy')).toBe("frame-ancestors 'none'")
+    expect(res.headers.get('content-security-policy')).toBe(
+      "frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+    )
   })
 
-  it('applies framing protection to /admin/api/* (admin API endpoints)', () => {
+  it('applies the admin CSP to /admin/api/* (admin API endpoints)', () => {
     const res = applySecurityHeaders(makeResponse('{}'), '/admin/api/cms/login')
     expect(res.headers.get('x-frame-options')).toBe('DENY')
-    expect(res.headers.get('content-security-policy')).toBe("frame-ancestors 'none'")
+    expect(res.headers.get('content-security-policy')).toBe(
+      "frame-ancestors 'none'; base-uri 'self'; object-src 'none'",
+    )
   })
 
   it('does NOT set X-Frame-Options on public page responses', () => {
