From 69b85e2d5384f66c0bf37f98efc2f208396bd0d7 Mon Sep 17 00:00:00 2001
From: Krzysztof Jelski <kjelski@gmail.com>
Date: Fri, 10 Jul 2020 15:35:07 +0200
Subject: [PATCH] Add Content Security Policy header. (#3158)

---
 .../src/electron/contentSecurityPolicy.ts     | 23 +++++++++++++++++++
 packages/apps-electron/src/electron/index.ts  |  2 ++
 2 files changed, 25 insertions(+)
 create mode 100644 packages/apps-electron/src/electron/contentSecurityPolicy.ts

diff --git a/packages/apps-electron/src/electron/contentSecurityPolicy.ts b/packages/apps-electron/src/electron/contentSecurityPolicy.ts
new file mode 100644
index 0000000000..7336842074
--- /dev/null
+++ b/packages/apps-electron/src/electron/contentSecurityPolicy.ts
@@ -0,0 +1,23 @@
+// Copyright 2017-2020 @polkadot/apps authors & contributors
+// This software may be modified and distributed under the terms
+// of the Apache-2.0 license. See the LICENSE file for details.
+
+import { HeadersReceivedResponse, session } from 'electron';
+
+export const setupContentSecurityPolicy = (environment: string): void => {
+  session.defaultSession.webRequest.onHeadersReceived((details, cb: (headersReceivedResponse: HeadersReceivedResponse) => void) => {
+    const headersReceivedResponse = {
+      responseHeaders: {
+        ...details.responseHeaders,
+        'Content-Security-Policy': [`default-src 'self' ${environment === 'development' ? "'unsafe-eval'" : ''};` +
+        " style-src-elem https://fonts.googleapis.com/css 'unsafe-inline';" +
+        " font-src data: 'self' https://fonts.gstatic.com;" +
+        " style-src 'unsafe-inline';" +
+        " connect-src 'self' wss:;" +
+        " img-src 'self' data:"]
+      }
+    };
+
+    cb(headersReceivedResponse);
+  });
+};
diff --git a/packages/apps-electron/src/electron/index.ts b/packages/apps-electron/src/electron/index.ts
index c12d852037..5e5524bff2 100644
--- a/packages/apps-electron/src/electron/index.ts
+++ b/packages/apps-electron/src/electron/index.ts
@@ -5,12 +5,14 @@
 import { app, shell } from 'electron';
 import { registerAccountStoreHandlers } from '../main/account-store';
 import { setupAutoUpdater } from './autoUpdater';
+import { setupContentSecurityPolicy } from './contentSecurityPolicy';
 import { createWindow } from './window';
 
 const ENV = process.env.NODE_ENV || 'production';
 
 const onReady = async () => {
   registerAccountStoreHandlers();
+  setupContentSecurityPolicy(ENV);
   await createWindow(ENV);
   await setupAutoUpdater();
 };