marcel/familienarchiv
1
0
Fork 0
Code Issues 121 Pull Requests 3 Actions 1 Packages Projects Releases Wiki Activity

docs(adr): record pdf.js wasm same-origin serving + future-CSP constraint
Some checks failed
CI / Unit & Component Tests (pull_request) Successful in 3m21s
Details
CI / OCR Service Tests (pull_request) Successful in 23s
Details
CI / fail2ban Regex (pull_request) Has been cancelled
Details
CI / Semgrep Security Scan (pull_request) Has been cancelled
Details
CI / Compose Bucket Idempotency (pull_request) Has been cancelled
Details
CI / Backend Unit Tests (pull_request) Has been cancelled
Details
CI / Unit & Component Tests (push) Successful in 3m18s
Details
CI / OCR Service Tests (push) Successful in 21s
Details
CI / Backend Unit Tests (push) Successful in 3m45s
Details
CI / fail2ban Regex (push) Successful in 44s
Details
CI / Semgrep Security Scan (push) Successful in 21s
Details
CI / Compose Bucket Idempotency (push) Successful in 1m3s
Details
nightly / deploy-staging (push) Successful in 2m14s
Details

Browse Source 
Promote the future-CSP constraint from an inline Caddyfile comment to a
durable ADR-028: serve the pdf.js wasm decoders same-origin (never a
CDN), any future CSP must allow 'wasm-unsafe-eval' + worker-src 'self'
blob:, and the build-time guard keeps the wasm shipping. Caddyfile now
points at the ADR.

Addresses re-review: Markus (constraint should be an ADR, not a comment).

Refs #708

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit was merged in pull request #713.
This commit is contained in:
Marcel
2026-06-01 21:15:58 +02:00
parent cb61e63b02
commit 420c0e3e10
2 changed files with 62 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
infra/caddy/Caddyfile
View File

@@ -25,7 +25,8 @@
# No Content-Security-Policy is set yet. When one is added, it MUST
# include `script-src 'wasm-unsafe-eval'` and `worker-src 'self' blob:`
# or the pdf.js WebAssembly image decoders (JBIG2/CCITTFax/JPEG2000)
# and worker will be blocked and scanned PDFs render blank. See #708.
# and worker will be blocked and scanned PDFs render blank.
# See #708 and docs/adr/028-pdfjs-wasm-decoders-and-csp-constraint.md.
-Server
}
}