neptune/ghost-portal
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Update CSP for ws (#4350)

Browse Source
This commit is contained in:
Jaco Greeff 2021-01-11 09:36:20 +01:00 committed by GitHub
parent ceab39361a
commit fea29170cd
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 6 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
packages/apps-electron/src/electron/contentSecurityPolicy.ts
View File

@ -4,23 +4,21 @@
import { HeadersReceivedResponse, session } from 'electron';
// eslint-disable-next-line @typescript-eslint/no-unused-vars
export const setupContentSecurityPolicy = (_: string): void => {
session.defaultSession.webRequest.onHeadersReceived((details, cb: (headersReceivedResponse: HeadersReceivedResponse) => void) => {
const headersReceivedResponse = {
export function setupContentSecurityPolicy (_: string): void {
session.defaultSession.webRequest.onHeadersReceived((details, respond: (response: HeadersReceivedResponse) => void) => {
respond({
responseHeaders: {
...details.responseHeaders,
'Content-Security-Policy': ["default-src 'self';" +
" style-src-elem 'self' https://fonts.googleapis.com/css 'unsafe-inline';" +
" font-src data: 'self' https://fonts.gstatic.com;" +
" style-src 'unsafe-inline';" +
" connect-src 'self' wss:;" +
" connect-src 'self' wss: ws:;" +
" img-src 'self' data:;" +
// unsafe-eval is needed for the WASM content - same as the extension
// script hashes here are for the window.top script (not technically needed)
" script-src 'self' 'unsafe-eval' 'sha256-02/ejyoV/iwRdJ4NAsxjzF6WVUtLMPM6Nv96EbAm6u8=' 'sha256-wW/WsLudCDaPo/ibpeK0KslHqYpCzcAKNFxFBXwCHJg='"]
}
};
cb(headersReceivedResponse);
});
});
};
}