Loosen the default Admin UI CSP about pocketbase HOT 3 CLOSED

Loading external resources in the Admin UI are not allowed for security reasons by the default Content security policy (CSP).

I'll think a little more on it later this week as I'm not sure what would be the best course of action here (adding exception for common websites vs enable all external iframes/images, add flag to change the csp, etc.).

from pocketbase.

After some more thought I decided to leave it as it is as I don't feel it is worth the risk allowing by default loading external media sources especially in the TinyMCE preview editor (see TinyMCE vulnerability fixes).

Technically loading external img-src is not a vulnerability vector on its own as the src in our cases is not allowed to be executed as JS but if the content of the field could be updated by non-admin users it could be used to try to find/track the admin IP or try to break/block the PocketBaser Admin UI in case the browser attempts to render 500MB remote img file.
For the iframe the situation is slightly more different but it too comes with some security concerns depending on where the user controlled iframe src is pointing to.

So for now I'll close the issue and classify it as a "known limitation" but with the refactoring I'll consider at least allowing users to overwrite the default CSP.

from pocketbase.

Side-note: In the future we'll replace TinyMCE entirely due to its recent v7 license change - tinymce/tinymce#9496.

from pocketbase.