openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

[PR #67] [MERGED] chore(security): harden file endpoints (CSP+XFO) #243

New Issue
Closed
opened 2026-02-15 17:16:28 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:28 -05:00
Owner
Copy Link
Copy Source

📋 Pull Request Information

Original PR: https://github.com/openclaw/clawhub/pull/67
Author: @vignesh07
Created: 1/28/2026
Status: ✅ Merged
Merged: 1/29/2026
Merged by: @thewilloftheshadow

Base: main ← Head: followup/file-endpoint-security

📝 Commits (1)

  • 8e168fb chore(security): harden file endpoints CSP + XFO + svg detection

📊 Changes

1 file changed (+18 additions, -4 deletions)

View changed files

📝 convex/httpApiV1.ts (+18 -4)

📄 Description

Follow-ups after #61 (merged):

  • Tighten CSP for skills/souls file-serving endpoints: add frame-ancestors 'none', base-uri 'none', form-action 'none' (keeps default-src 'none').
  • Add X-Frame-Options: DENY as an extra defense-in-depth layer.
  • Make SVG detection more robust by also checking file extension (.svg) in addition to content-type.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/openclaw/clawhub/pull/67 **Author:** [@vignesh07](https://github.com/vignesh07) **Created:** 1/28/2026 **Status:** ✅ Merged **Merged:** 1/29/2026 **Merged by:** [@thewilloftheshadow](https://github.com/thewilloftheshadow) **Base:** `main` ← **Head:** `followup/file-endpoint-security` --- ### 📝 Commits (1) - [`8e168fb`](https://github.com/openclaw/clawhub/commit/8e168fba851fe46e4529296d612fe07b7dc2c544) chore(security): harden file endpoints CSP + XFO + svg detection ### 📊 Changes **1 file changed** (+18 additions, -4 deletions) <details> <summary>View changed files</summary> 📝 `convex/httpApiV1.ts` (+18 -4) </details> ### 📄 Description Follow-ups after #61 (merged): - Tighten CSP for skills/souls file-serving endpoints: add `frame-ancestors 'none'`, `base-uri 'none'`, `form-action 'none'` (keeps `default-src 'none'`). - Add `X-Frame-Options: DENY` as an extra defense-in-depth layer. - Make SVG detection more robust by also checking file extension (`.svg`) in addition to content-type. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
yindo added the pull-request label 2026-02-15 17:16:28 -05:00
yindo closed this issue 2026-02-15 17:16:28 -05:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#243
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?