fix: csp regressions (#38047)

fix #37257 , all details are in the comments

modules/markup/asciicast/asciicast.go

@@ -1,49 +0,0 @@
-// Copyright 2023 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package asciicast
-
-import (
-	"fmt"
-	"io"
-	"net/url"
-
-	"gitea.dev/modules/markup"
-	"gitea.dev/modules/setting"
-)
-
-func init() {
-	markup.RegisterRenderer(Renderer{})
-}
-
-// Renderer implements markup.Renderer for asciicast files.
-// See https://github.com/asciinema/asciinema/blob/develop/doc/asciicast-v2.md
-type Renderer struct{}
-
-func (Renderer) Name() string {
-	return "asciicast"
-}
-
-func (Renderer) FileNamePatterns() []string {
-	return []string{"*.cast"}
-}
-
-const (
-	playerClassName = "asciinema-player-container"
-	playerSrcAttr   = "data-asciinema-player-src"
-)
-
-func (Renderer) SanitizerRules() []setting.MarkupSanitizerRule {
-	return []setting.MarkupSanitizerRule{{Element: "div", AllowAttr: playerSrcAttr}}
-}
-
-func (Renderer) Render(ctx *markup.RenderContext, _ io.Reader, output io.Writer) error {
-	rawURL := fmt.Sprintf("%s/%s/%s/raw/%s/%s",
-		setting.AppSubURL,
-		url.PathEscape(ctx.RenderOptions.Metas["user"]),
-		url.PathEscape(ctx.RenderOptions.Metas["repo"]),
-		ctx.RenderOptions.Metas["RefTypeNameSubURL"],
-		url.PathEscape(ctx.RenderOptions.RelativePath),
-	)
-	return ctx.RenderInternal.FormatWithSafeAttrs(output, `<div class="%s" %s="%s"></div>`, playerClassName, playerSrcAttr, rawURL)
-}

modules/markup/external/external.go

@@ -48,6 +48,11 @@ func RegisterRenderers() {
 		},
 	})
 
+	markup.RegisterRenderer(&frontendRenderer{
+		name:     "asciicast",
+		patterns: []string{"*.cast"},
+	})
+
 	for _, renderer := range setting.ExternalMarkupRenderers {
 		markup.RegisterRenderer(&Renderer{renderer})
 	}

modules/markup/external/frontend.go

@@ -5,6 +5,7 @@ package external
 
 import (
 	"encoding/base64"
+	"errors"
 	"io"
 	"unicode/utf8"
 
@@ -54,14 +55,13 @@ func (p *frontendRenderer) SanitizerRules() []setting.MarkupSanitizerRule {
 func (p *frontendRenderer) GetExternalRendererOptions() (ret markup.ExternalRendererOptions) {
 	ret.SanitizerDisabled = true
 	ret.DisplayInIframe = true
-	ret.ContentSandbox = "allow-scripts allow-forms allow-modals allow-popups allow-downloads"
+	ret.ContentSandbox = setting.MarkupRenderDefaultSandbox
 	return ret
 }
 
 func (p *frontendRenderer) Render(ctx *markup.RenderContext, input io.Reader, output io.Writer) error {
 	if ctx.RenderOptions.StandalonePageOptions == nil {
-		opts := p.GetExternalRendererOptions()
-		return markup.RenderIFrame(ctx, &opts, output)
+		return errors.New("should only be rendered in standalone page")
 	}
 
 	content, err := util.ReadWithLimit(input, int(setting.UI.MaxDisplayFileSize))

modules/markup/render.go

@@ -211,11 +211,11 @@ func RenderIFrame(ctx *RenderContext, opts *ExternalRendererOptions, output io.W
 		ctx.RenderOptions.Metas["RefTypeNameSubURL"],
 		util.PathEscapeSegments(ctx.RenderOptions.RelativePath),
 	)
-	var extraAttrs template.HTML
-	if opts.ContentSandbox != "" {
-		extraAttrs = htmlutil.HTMLFormat(` sandbox="%s"`, opts.ContentSandbox)
-	}
-	_, err := htmlutil.HTMLPrintf(output, `<iframe data-src="%s" data-global-init="initExternalRenderIframe" class="external-render-iframe"%s></iframe>`, src, extraAttrs)
+
+	// The render response should always have correct "sandbox" limits (no same-origin),
+	// otherwise the "render link" direct access can still cause XSS without iframe.
+	// So here we do not need to set sandbox attribute on the iframe.
+	_, err := htmlutil.HTMLPrintf(output, `<iframe data-src="%s" data-global-init="initExternalRenderIframe" class="external-render-iframe"></iframe>`, src)
 	return err
 }
 

modules/markup/render_test.go

@@ -22,10 +22,7 @@ func TestRenderIFrame(t *testing.T) {
 		WithRelativePath("tree-path").
 		WithMetas(map[string]string{"user": "test-owner", "repo": "test-repo", "RefTypeNameSubURL": "src/branch/master"})
 
-	// the value is read from config RENDER_CONTENT_SANDBOX, empty means "disabled"
-	ret := render(ctx, ExternalRendererOptions{ContentSandbox: ""})
+	// iframe doesn't need sandbox, the sandbox is set in render's response header
+	ret := render(ctx, ExternalRendererOptions{ContentSandbox: "any"})
 	assert.Equal(t, `<iframe data-src="/test-owner/test-repo/render/src/branch/master/tree-path" data-global-init="initExternalRenderIframe" class="external-render-iframe"></iframe>`, ret)
-
-	ret = render(ctx, ExternalRendererOptions{ContentSandbox: "allow"})
-	assert.Equal(t, `<iframe data-src="/test-owner/test-repo/render/src/branch/master/tree-path" data-global-init="initExternalRenderIframe" class="external-render-iframe" sandbox="allow"></iframe>`, ret)
 }

modules/setting/markup.go

@@ -237,6 +237,10 @@ func fileExtensionsToPatterns(sectionName string, extensions []string) []string
 	return patterns
 }
 
+// MarkupRenderDefaultSandbox only contains a safe set of "sandbox allow" values, it is used to protect users from XSS attack,
+// DO NOT USE "allow-same-origin" by default: if there is XSS in rendered content, same-origin makes the frame page can access parent window and send requests with user's credentials.
+const MarkupRenderDefaultSandbox = "allow-scripts allow-forms allow-modals allow-popups allow-downloads"
+
 func newMarkupRenderer(name string, sec ConfigSection) {
 	if !sec.Key("ENABLED").MustBool(false) {
 		return
@@ -269,9 +273,7 @@ func newMarkupRenderer(name string, sec ConfigSection) {
 		renderContentMode = RenderContentModeSanitized
 	}
 
-	// ATTENTION! at the moment, only a safe set like "allow-scripts" are allowed for sandbox mode.
-	// "allow-same-origin" should NEVER be used, it leads to XSS attack: makes the JS in iframe can access parent window's config and send requests with user's credentials.
-	renderContentSandbox := sec.Key("RENDER_CONTENT_SANDBOX").MustString("allow-scripts allow-popups")
+	renderContentSandbox := sec.Key("RENDER_CONTENT_SANDBOX").MustString(MarkupRenderDefaultSandbox)
 	if renderContentSandbox == "disabled" {
 		renderContentSandbox = ""
 	}

modules/setting/security.go

@@ -18,6 +18,8 @@ var Security = struct {
 	// TODO: move more settings to this struct in future
 	XFrameOptions       string
 	XContentTypeOptions string
+
+	ContentSecurityPolicyGeneral string // it only supports empty (default policy) or "unset", maybe it can support more in the future
 }{
 	XFrameOptions:       "SAMEORIGIN",
 	XContentTypeOptions: "nosniff",
@@ -150,13 +152,12 @@ func loadSecurityFrom(rootCfg ConfigProvider) {
 	SuccessfulTokensCacheSize = sec.Key("SUCCESSFUL_TOKENS_CACHE_SIZE").MustInt(20)
 
 	deprecatedSetting(rootCfg, "cors", "X_FRAME_OPTIONS", "security", "X_FRAME_OPTIONS", "v1.26.0")
-	if sec.HasKey("X_FRAME_OPTIONS") {
-		Security.XFrameOptions = sec.Key("X_FRAME_OPTIONS").MustString(Security.XFrameOptions)
-	} else {
+	if !sec.HasKey("X_FRAME_OPTIONS") {
 		Security.XFrameOptions = rootCfg.Section("cors").Key("X_FRAME_OPTIONS").MustString(Security.XFrameOptions)
 	}
-
-	Security.XContentTypeOptions = sec.Key("X_CONTENT_TYPE_OPTIONS").MustString(Security.XContentTypeOptions)
+	if err := sec.MapTo(&Security); err != nil {
+		log.Fatal("Failed to map security settings: %v", err)
+	}
 
 	twoFactorAuth := sec.Key("TWO_FACTOR_AUTH").String()
 	switch twoFactorAuth {

modules/setting/security_test.go

@@ -0,0 +1,22 @@
+// Copyright 2026 The Gitea Authors. All rights reserved.
+// SPDX-License-Identifier: MIT
+
+package setting
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestLoadSecurityFrom(t *testing.T) {
+	cfg, err := NewConfigProviderFromData(`[security]
+X_FRAME_OPTIONS = DENY
+X_CONTENT_TYPE_OPTIONS = unset
+CONTENT_SECURITY_POLICY_GENERAL = "script-src *; foo"`)
+	assert.NoError(t, err)
+	loadSecurityFrom(cfg)
+	assert.Equal(t, "DENY", Security.XFrameOptions)
+	assert.Equal(t, "unset", Security.XContentTypeOptions)
+	assert.Equal(t, `"script-src *`, Security.ContentSecurityPolicyGeneral) // holy shit ini package bug
+}