Jeremy Daer 2be2227f40 Allow scripts only from the asset directory, not the whole origin ...

Uploads are served from this origin too, so script-src 'self' would run one
that a cache still holds under a script type from before the upload guard.
Application pages now allow each importmap URL up to its asset directory
(relative root and asset host included), the inline importmap by hash, and
the service worker by worker-src.

2026-10-15 19:01:12 -07:00

..

active_storage_authentication.rb

Use header-only forgery protection and cache complete responses

2026-10-08 09:05:10 +02:00

active_storage.rb

Bound the work of previewing an attachment

2026-10-06 15:20:57 +02:00

assets.rb

Hello world

2025-08-21 09:31:59 +01:00

content_security_policy.rb

Allow scripts only from the asset directory, not the whole origin

2026-10-15 19:01:12 -07:00

extensions.rb

Hello world

2025-08-21 09:31:59 +01:00

filter_parameter_logging.rb

Upgrade to Rails 8 and Ruby 3.4.5 (#1)

2025-09-02 17:02:41 +02:00

fragment_cache.rb

Bound native fragment caching and collapse concurrent page renders

2026-10-07 21:38:36 +02:00

inflections.rb

Upgrade to Rails 8 and Ruby 3.4.5 (#1)

2025-09-02 17:02:41 +02:00

permissions_policy.rb

Hello world

2025-08-21 09:31:59 +01:00

resque.rb

Support Redis configuration with REDIS_URL env var

2026-08-24 11:26:38 -05:00

room_messages_count.rb

Simplify messages_count trigger install and harden ensure!

2026-10-07 19:46:57 +00:00

sentry.rb

Update Rails to main

2026-10-05 11:45:37 -04:00

session_store.rb

Use header-only forgery protection and cache complete responses

2026-10-08 09:05:10 +02:00

sqlite_wal_checkpoint.rb

Load WAL checkpointer outside Zeitwerk reload; harden fork stop

2026-10-07 19:05:44 +00:00

storage_paths.rb

Hello world

2025-08-21 09:31:59 +01:00

time_formats.rb

Update Rails to main

2026-10-05 11:45:37 -04:00

turbo_streams_authorization.rb

Authorize the room message stream at subscribe time

2026-08-03 14:55:12 -07:00

uploaded_script_guard.rb

Allow scripts only from the asset directory, not the whole origin

2026-10-15 19:01:12 -07:00

vapid.rb

Hello world

2025-08-21 09:31:59 +01:00

version.rb

Fix version number for CI built images

2026-07-30 18:34:54 +02:00

vips.rb

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

web_push.rb

Open pooled push connections as a Net::HTTP subclass that includes Stages

2026-10-09 23:41:45 +02:00