neptune/ghost-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Adjust CSP for workers (#4786)

Browse Source
This commit is contained in:
Jaco Greeff 2021-03-08 08:23:42 +01:00 committed by GitHub
parent 6540dd8080
commit e09a6de018
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
packages/apps-electron/src/electron/contentSecurityPolicy.ts
View File

@ -9,15 +9,19 @@ export function setupContentSecurityPolicy (_: string): void {
respond({
responseHeaders: {
...details.responseHeaders,
'Content-Security-Policy': ["default-src 'self';" +
" style-src-elem 'self' https://fonts.googleapis.com/css 'unsafe-inline';" +
" font-src data: 'self' https://fonts.gstatic.com;" +
" style-src 'unsafe-inline';" +
" connect-src 'self' wss: ws:;" +
" img-src 'self' data:;" +
// unsafe-eval is needed for the WASM content - same as the extension
// script hashes here are for the window.top script (not technically needed)
" script-src 'self' 'unsafe-eval' 'sha256-02/ejyoV/iwRdJ4NAsxjzF6WVUtLMPM6Nv96EbAm6u8=' 'sha256-wW/WsLudCDaPo/ibpeK0KslHqYpCzcAKNFxFBXwCHJg='"]
'Content-Security-Policy': [
"default-src 'self';" +
" style-src-elem 'self' https://fonts.googleapis.com/css 'unsafe-inline';" +
" font-src data: 'self' https://fonts.gstatic.com;" +
" style-src 'unsafe-inline';" +
" connect-src 'self' wss: ws:;" +
" img-src 'self' data:;" +
// react-qr-reader uses an embedded blob
" worker-src 'self' blob: filesystem:;" +
// unsafe-eval is needed for the WASM content - same as the extension
// script hashes here are for the window.top script (not technically needed)
" script-src 'self' 'unsafe-eval' 'sha256-02/ejyoV/iwRdJ4NAsxjzF6WVUtLMPM6Nv96EbAm6u8=' 'sha256-wW/WsLudCDaPo/ibpeK0KslHqYpCzcAKNFxFBXwCHJg='"
]
}
});
});