Skip to content
This repository has been archived by the owner on Sep 7, 2023. It is now read-only.

Handle double-bang redirections better for CSP #3262

Open
sevmonster opened this issue Jun 12, 2022 · 1 comment
Open

Handle double-bang redirections better for CSP #3262

sevmonster opened this issue Jun 12, 2022 · 1 comment

Comments

@sevmonster
Copy link

Is your feature request related to a problem? Please describe.
When using double-bangs with POST requests, the site you will be redirected to must be added to form-action CSP else it will be blocked for violation.

Describe the solution you'd like
Find a way to not send form data when redirecting to another site with double-bangs so that every engine does not need to be added to CSP.

Describe alternatives you've considered
Started adding sites to CSP—it quickly becomes unmaintainable.

Example
On my server, try to search for "Nagios !!alternativeto". Since
I did not add alternativeto.net to form-action, this is the result:
image

Additional context
Related: searxng/searxng#140

@sevmonster
Copy link
Author

I somehow managed to open this in the completely wrong repository... But I will leave it open here though in case this is an issue that vanilla searx suffers from. Feel free to close if this is not applicable.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Projects
None yet
Development

No branches or pull requests

1 participant