Jeremy Daer c3616f81b4 Enforce a script policy that allows the importmap by hash ...

script-src 'self', object-src 'none' and base-uri 'self', enforced. The
two inline scripts the importmap helper emits are allowed by their
SHA-256, and the origins its URLs point to (a configured asset host, in
any form Rails accepts) are allowed by name. There is no per-request
nonce, so cached pages stay valid.

DISABLE_CONTENT_SECURITY_POLICY=true leaves the policy off, for an
install whose proxy or customization injects scripts.

(cherry picked from commit 562888251e)

Backport: 1.5.2 has no response cache, so the cached-page test is left out.

2026-10-17 00:47:32 -07:00

..

channels

Keep same-second unread events and bound idle push connections

2026-10-07 11:00:47 +02:00

controllers

Render a complete auto-submit transfer form

2026-10-07 17:08:48 +02:00

fixtures

Hash fixture passwords at minimum bcrypt cost

2026-09-29 09:53:39 +07:00

helpers

Link URLs only in a message's text

2026-10-17 00:46:37 -07:00

integration

Enforce a script policy that allows the importmap by hash

2026-10-17 00:47:32 -07:00

lib

Keep same-second unread events and bound idle push connections

2026-10-07 11:00:47 +02:00

middleware

Serve uploads that aren't media as downloads

2026-10-17 00:47:22 -07:00

models

Stop sending push notifications to banned users (#338)

2026-10-07 11:25:16 -07:00

performance

Hello world

2025-08-21 09:31:59 +01:00

system

Quote a mention as text when replying

2026-10-17 00:46:37 -07:00

test_helpers

Reuse push connections pinned to the address the guard just approved

2026-10-05 18:24:41 +02:00

application_system_test_case.rb

Replace Trix with Lexxy

2026-09-26 09:13:27 +02:00

test_helper.rb

Update Rails to main

2026-10-05 11:45:37 -04:00