From 4a5e9a67ca7f1ec6e1881352303b4df176e3196d Mon Sep 17 00:00:00 2001 From: Edouard Vanbelle Date: Tue, 26 May 2026 01:50:59 +0200 Subject: [PATCH] permits img-src from external website, other solution is to store base64 image of user in DB note: if we need to keep this security, we need to store all user's images (blob_storage can be a good candidate) --- src/interfaces/api/handlers/auth_handler.rs | 2 +- src/main.rs | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/interfaces/api/handlers/auth_handler.rs b/src/interfaces/api/handlers/auth_handler.rs index d5a90f50..550385ab 100644 --- a/src/interfaces/api/handlers/auth_handler.rs +++ b/src/interfaces/api/handlers/auth_handler.rs @@ -326,7 +326,7 @@ async fn get_current_user( /// DTO for updating the user's profile image. #[derive(Debug, Deserialize, ToSchema)] pub struct UpdateUserImageDto { - /// New image URL (https/http) or data URI (data:image/…;base64,…). Null to clear. + /// Image URL (https/http) or data URI (data:image/png|webp|jpeg;base64,…). Null to clear. pub image: Option, } diff --git a/src/main.rs b/src/main.rs index 16d17614..8ba921f5 100644 --- a/src/main.rs +++ b/src/main.rs @@ -525,7 +525,7 @@ async fn main() -> Result<(), Box> { script-src 'self'; \ worker-src 'self'; \ style-src 'self' 'unsafe-inline'; \ - img-src 'self' data: blob:; \ + img-src 'self' data: blob: https:; \ media-src 'self' blob:; \ connect-src 'self'; \ font-src 'self' data:; \