From fbe4f3222bf4b4287f0588f3c8d2007ced923b63 Mon Sep 17 00:00:00 2001 From: "Simon L." Date: Thu, 10 Sep 2026 13:17:16 +0200 Subject: [PATCH 1/6] tighten jellyfins csp settings and add a comment to eurooffice csp settings Signed-off-by: Simon L. --- apps/eurooffice_docker.sh | 2 ++ not-supported/jellyfin.sh | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/apps/eurooffice_docker.sh b/apps/eurooffice_docker.sh index 2aa03e327d..8548e182b5 100644 --- a/apps/eurooffice_docker.sh +++ b/apps/eurooffice_docker.sh @@ -205,6 +205,8 @@ then Header set X-XSS-Protection "1; mode=block" Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Header set X-Content-Type-Options nosniff + # Only 'frame-ancestors' on purpose: EuroOffice documents no CSP for their Apache proxy + # example, and a self-invented one would just break the editor iframe inside Nextcloud. Header set Content-Security-Policy "frame-ancestors 'self' $NCDOMAIN" # contra mixed content warnings diff --git a/not-supported/jellyfin.sh b/not-supported/jellyfin.sh index 32b42a98b2..63f292c5a5 100644 --- a/not-supported/jellyfin.sh +++ b/not-supported/jellyfin.sh @@ -447,7 +447,9 @@ then Header set X-XSS-Protection "1; mode=block" Header set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" Header set X-Content-Type-Options nosniff - Header set Content-Security-Policy "frame-ancestors 'self' $NCDOMAIN" + # Jellyfin sends no CSP itself and only publishes one in its nginx example (not the apache + # one), so we translate that policy to apache: https://jellyfin.org/docs/general/post-install/networking/reverse-proxy/nginx/ + Header set Content-Security-Policy "default-src https: data: blob:; img-src 'self' https://* data:; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline' https://www.gstatic.com https://www.youtube.com blob:; worker-src 'self' blob:; connect-src 'self'; object-src 'none'; font-src 'self'; frame-ancestors 'self'" # contra mixed content warnings RequestHeader set X-Forwarded-Proto "https" From b5479e2ab37a4f9f01be0d8896ddbdaec782352e Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:40:45 +0000 Subject: [PATCH 2/6] ci: bump reviewdog misspell action to latest v1 SHA Co-authored-by: enoch85 <4511254+enoch85@users.noreply.github.com> --- .github/workflows/reviewdog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml index 798fb65c36..7c9273be9d 100644 --- a/.github/workflows/reviewdog.yml +++ b/.github/workflows/reviewdog.yml @@ -27,7 +27,7 @@ jobs: - name: spelling or typos uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - name: misspell - uses: reviewdog/action-misspell@d6429416b12b09b4e2768307d53bef58d172e962 # v1 + uses: reviewdog/action-misspell@ba7ac4030fa6812f8c8b2d4e516af8bc99553c32 # v1 with: github_token: ${{ secrets.github_token }} locale: "US" From 31e13f613a36535e0e96d60d830ee229a0404705 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:41:46 +0000 Subject: [PATCH 3/6] ci: use reviewdog misspell v1 tag instead of SHA Co-authored-by: enoch85 <4511254+enoch85@users.noreply.github.com> --- .github/workflows/reviewdog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml index 7c9273be9d..2bff973a46 100644 --- a/.github/workflows/reviewdog.yml +++ b/.github/workflows/reviewdog.yml @@ -27,7 +27,7 @@ jobs: - name: spelling or typos uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - name: misspell - uses: reviewdog/action-misspell@ba7ac4030fa6812f8c8b2d4e516af8bc99553c32 # v1 + uses: reviewdog/action-misspell@v1 with: github_token: ${{ secrets.github_token }} locale: "US" From 8f2550847dac85c709e00916b031775b696b3226 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:42:19 +0000 Subject: [PATCH 4/6] ci: use reviewdog misspell v1.28.0 tag Co-authored-by: enoch85 <4511254+enoch85@users.noreply.github.com> --- .github/workflows/reviewdog.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml index 2bff973a46..fefe13750f 100644 --- a/.github/workflows/reviewdog.yml +++ b/.github/workflows/reviewdog.yml @@ -27,7 +27,7 @@ jobs: - name: spelling or typos uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - name: misspell - uses: reviewdog/action-misspell@v1 + uses: reviewdog/action-misspell@v1.28.0 with: github_token: ${{ secrets.github_token }} locale: "US" From df194e86ab3763a8b4556f508207528dc2a1f804 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:42:50 +0000 Subject: [PATCH 5/6] ci: document tag exception for misspell action Co-authored-by: enoch85 <4511254+enoch85@users.noreply.github.com> --- .github/workflows/reviewdog.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml index fefe13750f..997dd5bced 100644 --- a/.github/workflows/reviewdog.yml +++ b/.github/workflows/reviewdog.yml @@ -27,6 +27,7 @@ jobs: - name: spelling or typos uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 - name: misspell + # Version tag requested by maintainer instead of a pinned SHA. uses: reviewdog/action-misspell@v1.28.0 with: github_token: ${{ secrets.github_token }} From 671f0441ccafa4e52f06e07912633f0b47063a38 Mon Sep 17 00:00:00 2001 From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com> Date: Thu, 10 Sep 2026 17:46:28 +0000 Subject: [PATCH 6/6] ci: switch action pins to version refs in workflows Co-authored-by: enoch85 <4511254+enoch85@users.noreply.github.com> --- .github/workflows/check-code-with-shellcheck.yml | 4 ++-- .github/workflows/reviewdog.yml | 6 +++--- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/.github/workflows/check-code-with-shellcheck.yml b/.github/workflows/check-code-with-shellcheck.yml index 3db0e7438e..7aedf758a8 100644 --- a/.github/workflows/check-code-with-shellcheck.yml +++ b/.github/workflows/check-code-with-shellcheck.yml @@ -10,9 +10,9 @@ jobs: name: Github Actions runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: actions/checkout@v7.0.1 - name: Run Shellcheck - uses: ludeeus/action-shellcheck@00b27aa7cb85167568cb48a3838b75f4265f2bca # master + uses: ludeeus/action-shellcheck@2.0.0 with: check_together: 'yes' env: diff --git a/.github/workflows/reviewdog.yml b/.github/workflows/reviewdog.yml index 997dd5bced..7967e2fb55 100644 --- a/.github/workflows/reviewdog.yml +++ b/.github/workflows/reviewdog.yml @@ -11,9 +11,9 @@ jobs: name: Shellcheck testing runs-on: ubuntu-latest steps: - - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + - uses: actions/checkout@v7.0.1 - name: shellcheck - uses: reviewdog/action-shellcheck@0722bbdb0d47f04c1b53b8734d2422ac63a45ec6 # v1 + uses: reviewdog/action-shellcheck@v1.32.1 with: github_token: ${{ secrets.github_token }} reporter: github-pr-review @@ -25,7 +25,7 @@ jobs: runs-on: ubuntu-latest steps: - name: spelling or typos - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v6 + uses: actions/checkout@v7.0.1 - name: misspell # Version tag requested by maintainer instead of a pinned SHA. uses: reviewdog/action-misspell@v1.28.0