From c7ad38e445e656f5f46d4421903b3ee025d780c3 Mon Sep 17 00:00:00 2001
From: ionfwsrijan <ionfwsrijan@users.noreply.github.com>
Date: Tue, 11 Aug 2026 09:38:39 +0530
Subject: [PATCH] fix: allow GitHub avatar hosts in CSP img-src (issue #1875)

---
 src/app.py          |  2 +-
 tests/test_basic.py | 14 ++++++++++++++
 2 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/src/app.py b/src/app.py
index 0d40969e..56eb8a5f 100644
--- a/src/app.py
+++ b/src/app.py
@@ -130,7 +130,7 @@ def add_security_headers(response):
         "default-src 'self'; "
         "script-src 'self' 'unsafe-inline'; "
         "style-src 'self' 'unsafe-inline'; "
-        "img-src 'self' data:; "
+        "img-src 'self' data: https://avatars.githubusercontent.com https://*.githubusercontent.com; "
         "font-src 'self'; "
         "connect-src 'self'; "
         "form-action 'self' https://formspree.io https://api.web3forms.com; "
diff --git a/tests/test_basic.py b/tests/test_basic.py
index fe1431ae..c25f9d90 100644
--- a/tests/test_basic.py
+++ b/tests/test_basic.py
@@ -479,6 +479,20 @@ def test_security_headers_present():
         == "geolocation=(), microphone=(), camera=()"
     )
 
+def test_csp_allows_github_avatars():
+    """img-src must whitelist GitHub avatar hosts so profile avatars load (issue #1875)."""
+    client = get_client()
+    response = client.get("/")
+
+    csp = response.headers["Content-Security-Policy"]
+    img_src = next(
+        part.strip()
+        for part in csp.split(";")
+        if part.strip().startswith("img-src ")
+    )
+    assert "https://avatars.githubusercontent.com" in img_src
+    assert "https://*.githubusercontent.com" in img_src
+
 def test_recommend_api_single_interest():
     client = get_client()
     response = client.post("/api/recommend", json={