From eb9a7e36260c99aec980d097ee819c17ebb93631 Mon Sep 17 00:00:00 2001
From: Yamagishi Kazutoshi <ykzts@desire.sh>
Date: Tue, 15 Mar 2022 03:20:40 +0900
Subject: [PATCH] Fix LetterOpennerWeb CSP (#17770)
---
config/initializers/content_security_policy.rb | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb
index b377b7b4d..c113b0f8b 100644
--- a/config/initializers/content_security_policy.rb
+++ b/config/initializers/content_security_policy.rb
@@ -60,4 +60,20 @@ Rails.application.reloader.to_prepare do
PgHero::HomeController.after_action do
request.content_security_policy_nonce_generator = nil
end
+
+ if Rails.env.development?
+ LetterOpenerWeb::LettersController.content_security_policy do |p|
+ p.child_src :self
+ p.connect_src :none
+ p.frame_ancestors :self
+ p.frame_src :self
+ p.script_src :unsafe_inline
+ p.style_src :unsafe_inline
+ p.worker_src :none
+ end
+
+ LetterOpenerWeb::LettersController.after_action do |p|
+ request.content_security_policy_nonce_directives = %w(script-src)
+ end
+ end
end