@nocobase/cli 2.1.25 → 2.1.26

package/assets/env-proxy/nginx/snippets/uploads-location.conf

@@ -1,12 +1,14 @@
 add_header Cache-Control "public" always;
+add_header Content-Security-Policy "sandbox" always;
 add_header X-Content-Type-Options "nosniff" always;
 
 access_log off;
 autoindex off;
 
 # Force potentially renderable uploaded files to download.
-location ~* \.(?:htm|html|svg|svgz|xhtml)$ {
+location ~* \.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$ {
     add_header Cache-Control "public" always;
+    add_header Content-Security-Policy "sandbox" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Content-Disposition "attachment" always;
 }
@@ -16,6 +18,7 @@ location ~* \.md$ {
     default_type text/markdown;
 
     add_header Cache-Control "public" always;
+    add_header Content-Security-Policy "sandbox" always;
     add_header X-Content-Type-Options "nosniff" always;
     add_header Content-Disposition "inline" always;
 }

package/dist/lib/env-proxy.js

@@ -1000,15 +1000,17 @@ function renderNginxLocationTemplate(context) {
         default_type text/markdown;
         add_header Cache-Control "public";
         add_header Content-Disposition "inline";
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
     }
 
-    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.(?:htm|html|svg|svgz|xhtml|pdf))$ {
+    location ~* ^${context.appPublicPath}storage/uploads/(.*\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt))$ {
         alias ${context.uploadsPath}/$1;
         add_header Cache-Control "public";
         add_header Content-Disposition "attachment" always;
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
@@ -1017,6 +1019,7 @@ function renderNginxLocationTemplate(context) {
     location ${context.appPublicPath}storage/uploads/ {
         alias ${context.uploadsPath}/;
         add_header Cache-Control "public";
+        add_header Content-Security-Policy "sandbox" always;
         add_header X-Content-Type-Options "nosniff" always;
         access_log off;
         autoindex off;
@@ -1136,10 +1139,14 @@ function renderCaddyAppTemplate(siteAddress, context, publicDir) {
         `${siteAddress} {`,
         `    encode zstd gzip${rootRedirectBlock}${appPublicPathRedirectBlock}${modernClientRedirectBlock}${shorthandModernClientRedirectBlock}`,
         '',
+        '    @activeUploadedContent path_regexp activeUploadedContent (?i)\\.(?:htm|html|pdf|svg|svgz|xht|xhtml|xml|xsl|xslt)$',
+        '',
         `    handle_path ${uploadsPathMatcher} {`,
         `        root * ${context.uploadsPath}`,
         '        header Cache-Control public',
+        '        header Content-Security-Policy sandbox',
         '        header X-Content-Type-Options nosniff',
+        '        header @activeUploadedContent Content-Disposition attachment',
         '        file_server',
         '    }',
         '',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nocobase/cli",
-  "version": "2.1.25",
+  "version": "2.1.26",
   "description": "NocoBase Command Line Tool",
   "type": "module",
   "main": "dist/generated/command-registry.js",
@@ -144,5 +144,5 @@
     "type": "git",
     "url": "git+https://github.com/nocobase/nocobase.git"
   },
-  "gitHead": "f3326a2681004deee97b563fb6ab04744e26ac71"
+  "gitHead": "b25700115794487b342ac33a63a1a988c75c112c"
 }