From 807ae3d4fa69d4058a5f886b922efb570fb27227 Mon Sep 17 00:00:00 2001
From: Luca <102960244+Luca-Timo@users.noreply.github.com>
Date: Wed, 3 Jun 2026 14:37:40 +0200
Subject: [PATCH] fix(security): block script execution in served SVGs via CSP
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Serve uploaded SVGs (admin logos etc.) with a restrictive
Content-Security-Policy (default-src 'none'; style-src 'unsafe-inline';
img-src 'self' data:) + X-Content-Type-Options: nosniff in secureStatic.
The browser still renders the vector, but any embedded <script>/on*
handler can't execute if the SVG is opened directly — keeps real SVGs
(scalable) instead of rasterising them. Applies to all secureStatic
mounts (uploads/photos/thumbnails/fonts); only SVGs get the header.
---
 backend/src/middleware/secureStatic.js | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/backend/src/middleware/secureStatic.js b/backend/src/middleware/secureStatic.js
index 185d9d42..2572d3d2 100644
--- a/backend/src/middleware/secureStatic.js
+++ b/backend/src/middleware/secureStatic.js
@@ -31,7 +31,22 @@ function secureStatic(basePath, options = {}) {
         // Disable directory listing for security
         index: false,
         // Don't allow dotfiles
-        dotfiles: 'deny'
+        dotfiles: 'deny',
+        setHeaders: (resp, filePath) => {
+          // Preserve any caller-provided header logic (e.g. font caching).
+          if (typeof options.setHeaders === 'function') options.setHeaders(resp, filePath);
+          // SVGs are admin-uploadable (logos, favicon). Served from our
+          // own origin, a malicious SVG opened directly could run embedded
+          // <script>/on* handlers (stored XSS). A restrictive CSP lets the
+          // browser RENDER the vector but blocks all script execution —
+          // so we keep real SVGs (scalable) instead of rasterising them.
+          // `default-src 'none'` already implies script-src 'none';
+          // style-src + img-src(data:) keep normal SVG rendering working.
+          if (/\.svg$/i.test(filePath)) {
+            resp.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'; img-src 'self' data:");
+            resp.setHeader('X-Content-Type-Options', 'nosniff');
+          }
+        }
       });
       
       return staticMiddleware(req, res, next);