remote/navidrome
1
0
Fork 0
mirror of https://github.com/navidrome/navidrome.git synced 2026-10-26 10:17:09 +01:00
Code Issues Projects Releases Packages Wiki Activity

fix(plugins): correct Rust codegen serde attributes and harden endpoint responses

Browse source 
Fix two issues from PR #5045 review. The Rust code generator was
producing incorrect skip_serializing_if attributes: map types incorrectly
used Option::is_none instead of HashMap::is_empty, and the bare int type
for HTTPHandleResponse.Status fell through to the default Option::is_none
case. The map fix is in skipSerializingFunc; the int issue is fixed at the
source by changing Status from int to int32 (HTTP status codes always fit
in int32, and this avoids platform-dependent int sizing on i386 vs amd64).

Additionally, plugin HTTP responses now include forced security headers
(X-Content-Type-Options: nosniff and a restrictive Content-Security-Policy
with sandbox) to prevent XSS from compromised plugins serving HTML+JS on
the same origin as Navidrome.
This commit is contained in:
Deluan 2026-02-13 13:43:41 -05:00
commit 9a004fd043
8 changed files with 57 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

2
plugins/capabilities/http_endpoint.go
View file

@ -44,7 +44,7 @@ type HTTPUser struct {
// HTTPHandleResponse is the response returned by the plugin's HandleRequest function.
type HTTPHandleResponse struct {
// Status is the HTTP status code. Defaults to 200 if zero or not set.
Status int `json:"status,omitempty"`
Status int32 `json:"status,omitempty"`
// Headers contains the HTTP response headers to set.
Headers map[string][]string `json:"headers,omitempty"`
// Body is the response body content.