gitea/nas
1
0
Fork 2
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 3

Change img-src and media-src CSP directives to not include https: (#28025)

Browse source
This commit is contained in:
Claire 2023-11-30 14:47:01 +01:00 • committed by GitHub
parent bb0efe16e6
commit 85662a5a57
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
4 changed files with 17 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

10
config/initializers/content_security_policy.rb
View file

@ -10,7 +10,7 @@ require_relative '../../app/lib/content_security_policy'
policy = ContentSecurityPolicy.new
assets_host = policy.assets_host
media_host = policy.media_host
media_hosts = policy.media_hosts
def sso_host
return unless ENV['ONE_CLICK_SSO_LOGIN'] == 'true'
@ -35,9 +35,9 @@ Rails.application.config.content_security_policy do |p|
p.default_src :none
p.frame_ancestors :none
p.font_src :self, assets_host
p.img_src :self, :https, :data, :blob, assets_host
p.img_src :self, :data, :blob, *media_hosts
p.style_src :self, assets_host
p.media_src :self, :https, :data, assets_host
p.media_src :self, :data, *media_hosts
p.frame_src :self, :https
p.manifest_src :self, assets_host
@ -54,10 +54,10 @@ Rails.application.config.content_security_policy do |p|
webpacker_public_host = ENV.fetch('WEBPACKER_DEV_SERVER_PUBLIC', Webpacker.config.dev_server[:public])
webpacker_urls = %w(ws http).map { |protocol| "#{protocol}#{Webpacker.dev_server.https? ? 's' : ''}://#{webpacker_public_host}" }
p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url, *webpacker_urls
p.connect_src :self, :data, :blob, *media_hosts, Rails.configuration.x.streaming_api_base_url, *webpacker_urls
p.script_src :self, :unsafe_inline, :unsafe_eval, assets_host
else
p.connect_src :self, :data, :blob, assets_host, media_host, Rails.configuration.x.streaming_api_base_url
p.connect_src :self, :data, :blob, *media_hosts, Rails.configuration.x.streaming_api_base_url
p.script_src :self, assets_host, "'wasm-unsafe-eval'"
end
end