Page MenuHomePhabricator
Differential D19154

Add "object-src 'none'" to the Content-Security-Policy
ClosedPublic
Actions

Authored by epriestley on Feb 28 2018, 10:17 PM.
Tags
None
Referenced Files
F19097608: D19154.id.diff
Dec 4 2025, 2:00 PM
F19089241: D19154.diff
Dec 3 2025, 6:24 AM
F18926999: D19154.id45889.diff
Nov 9 2025, 8:35 PM
F18896868: D19154.id45885.diff
Nov 7 2025, 4:31 PM
F18877870: D19154.id.diff
Nov 6 2025, 12:28 PM
F18856995: D19154.diff
Nov 1 2025, 12:33 PM
F18746888: D19154.id.diff
Oct 3 2025, 1:50 PM
F18659477: D19154.diff
Sep 23 2025, 12:42 PM
View All Files
Subscribers
None

Details

Reviewers
None
Maniphest Tasks
T4340: Implement Content-Security-Policy and Strict-Transport-Security headers
Commits
rPa5efd7eedb3c: Add "object-src 'none'" to the Content-Security-Policy
Summary

See PHI399. Ref T4340. We don't require Flash/Java anywhere and can safely block them unconditionally in the Content-Security-Policy header.

Test Plan

Added a <object ... /> tag to a page, saw "Blocked Plug-In" and a CSP warning in the browser console.

Diff Detail

Repository
rP Phabricator
Lint
Lint Not Applicable
Unit
Tests Not Applicable

Event Timeline

epriestley created this revision.Feb 28 2018, 10:17 PM
Harbormaster completed remote builds in B19696: Diff 45885.Feb 28 2018, 10:18 PM
epriestley requested review of this revision.Feb 28 2018, 10:18 PM
epriestley added a child revision: D19155: Remove defunct "download" route in Files pointing to nonexistent controller.Feb 28 2018, 11:21 PM
This revision was not accepted when it landed; it landed in state Needs Review.Mar 1 2018, 1:19 AM
Closed by commit rPa5efd7eedb3c: Add "object-src 'none'" to the Content-Security-Policy (authored by epriestley). · Explain Why
This revision was automatically updated to reflect the committed changes.

Revision Contents
Changeset List

PathSize
src/
aphront/
response/
3 lines

Diff 45889

View Options

src/aphront/response/AphrontResponse.php

Loading...
Phabricator · Built by Phacility