Jeremy Daer 562888251e Enforce a script policy that allows the importmap by hash ...

script-src 'self', object-src 'none' and base-uri 'self', enforced. The
two inline scripts the importmap helper emits are allowed by their
SHA-256, and the origins its URLs point to (a configured asset host, in
any form Rails accepts) are allowed by name. There is no per-request
nonce, so cached pages stay valid.

DISABLE_CONTENT_SECURITY_POLICY=true leaves the policy off, for an
install whose proxy or customization injects scripts.

2026-10-15 19:01:12 -07:00

..

accounts

Disable libvips unfuzzed operations (#226)

2026-07-28 11:57:57 -04:00

autocompletable

Hello world

2025-08-21 09:31:59 +01:00

concerns

Add IP-based user banning

2025-11-26 14:30:38 +00:00

messages

Keep transaction guards temporary and simplify quick boost forms

2026-10-08 12:40:31 +02:00

rooms

Delete a room's messages in a job, one transaction each

2026-10-06 13:57:05 +02:00

sessions

Render a complete auto-submit transfer form

2026-10-07 17:08:48 +02:00

users

Leave members who are unread already out of a new message's update

2026-10-07 16:41:20 +02:00

.keep

Hello world

2025-08-21 09:31:59 +01:00

accounts_controller_test.rb

Merge pull request #316: List one page of account members at a time

2026-10-07 10:32:12 +02:00

active_storage_authentication_test.rb

Require authentication for Active Storage direct uploads (#267)

2026-08-30 10:24:41 -07:00

cached_responses_test.rb

Enforce a script policy that allows the importmap by hash

2026-10-15 19:01:12 -07:00

fetch_metadata_test.rb

Use header-only forgery protection and cache complete responses

2026-10-08 09:05:10 +02:00

first_runs_controller_test.rb

Address race condition during "first run" account creation

2025-12-12 10:51:28 -05:00

fragment_cache_test.rb

Retain content-validated message fragments across unrelated commits

2026-10-08 12:00:45 +02:00

messages_caching_test.rb

Merge pull request #330: bound attachment preview work

2026-10-07 10:33:02 +02:00

messages_controller_test.rb

Reuse token-free message controls and render posting deliveries once

2026-10-08 11:43:27 +02:00

qr_code_controller_test.rb

Reject a QR code request that can't become a QR code

2026-10-06 22:53:47 +02:00

rooms_controller_test.rb

Reset former members' connections and grant open rooms in one statement

2026-10-06 14:45:18 +02:00

searches_controller_test.rb

Search for operator words instead of parsing them

2026-10-05 01:08:53 +02:00

sessions_controller_test.rb

Close live Action Cable connections on sign out (#268)

2026-08-31 18:21:16 -07:00

unfurl_links_controller_test.rb

Put the whole unfurl, lookups included, under one deadline

2026-10-06 14:03:26 +02:00

users_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00

welcome_controller_test.rb

Hello world

2025-08-21 09:31:59 +01:00