Prefer narrow allowlists when a security hardening breaks a legitimate browser path

Summary#

Blanket security changes often break one legitimate rendering path that was relying on previous permissive behavior. Keep the secure default in place for the broad surface area, then carve out the smallest explicit exception for the known-safe resource instead of rolling back the protection wholesale.

Problem#

A global attachment/XSS hardening change prevented a specific stylesheet asset from loading in-browser.

Solution#

Preserve the hardened default for all user-controlled files, and add a tightly scoped exception for the single asset type that must render inline, with its behavior documented and regression-tested.

Failure Modes#

Reverting the entire hardening because one asset broke
Expanding the exception from one file to a broad file class without threat review
Forgetting to test both the safe exception and the still-restricted default path

Sources#

https://github.com/Comfy-Org/ComfyUI/pull/15268
https://github.com/Comfy-Org/ComfyUI/pull/15155
https://github.com/Comfy-Org/ComfyUI/pull/15244
https://github.com/Comfy-Org/ComfyUI/pull/15239
https://github.com/Comfy-Org/ComfyUI/pull/15228
https://github.com/Comfy-Org/ComfyUI/pull/15224
https://github.com/Comfy-Org/ComfyUI/pull/15231
https://github.com/Comfy-Org/ComfyUI/pull/15000
https://github.com/GitHubDaily/GitHubDaily/pull/267
https://github.com/GitHubDaily/GitHubDaily/pull/52
https://github.com/fastapi/full-stack-fastapi-template/pull/2399
https://github.com/fastapi/full-stack-fastapi-template/pull/2397
https://github.com/fastapi/full-stack-fastapi-template/pull/2400
https://github.com/fastapi/full-stack-fastapi-template/pull/2398
https://github.com/fastapi/full-stack-fastapi-template/pull/2394
https://github.com/fastapi/full-stack-fastapi-template/pull/2393
https://github.com/fastapi/full-stack-fastapi-template/pull/2392
https://github.com/fastapi/full-stack-fastapi-template/pull/2389
https://github.com/fastapi/full-stack-fastapi-template/pull/2386
https://github.com/react/react/pull/37185
https://github.com/react/react/pull/37186
https://github.com/react/react/pull/37187
https://github.com/react/react/pull/37137
https://github.com/thedaviddias/Front-End-Checklist/pull/664
https://github.com/thedaviddias/Front-End-Checklist/pull/680
mined_at: 2026-08-04T04:56:25Z

Sagwan Revalidation 2026-08-04T05:37:10Z#

verdict: ok
note: 좁은 허용목록으로 보안 기본값을 유지하라는 권장은 여전히 유효하다.

Sagwan Revalidation 2026-08-08T01:27:01Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-10T13:44:11Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-13T01:32:14Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-15T13:46:15Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-18T02:25:59Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-20T14:51:02Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-23T03:10:41Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-25T16:00:37Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-28T04:01:42Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-08-30T15:53:13Z#

verdict: ok
note: [chatgpt HTTP 401] {

Sagwan Revalidation 2026-09-02T05:51:22Z#

verdict: ok
note: 최소 예외로 보안 기본값을 유지하라는 권장안은 여전히 유효함

Sagwan Revalidation 2026-09-08T08:48:28Z#

verdict: ok
note: 좁은 예외로 보안 기본값을 유지하라는 권장은 여전히 유효하다.

Sagwan Revalidation 2026-09-10T22:05:17Z#

verdict: ok
note: [chatgpt HTTP 429] {"error":{"type":"usage_limit_reached","message":"The usage limit has been reached","plan_type":"prolite","resets_at":1789436461,"eligible_pr

Sagwan Revalidation 2026-09-13T18:07:58Z#

verdict: ok
note: 보안 허용 목록 원칙은 시간 독립적이며, 3일 전 검증 직후이고 주요 주장·링크 모두 유효하다.