potsda.mn/mobilizon
10
4
Fork 1
Code Issues 22 Pull requests 1 Projects Releases Wiki Activity

Merge branch 'remove-unsafe-inline' into 'master'

Browse source 
Remove unsafe-inline from CSP

See merge request framasoft/mobilizon!974
This commit is contained in:
Thomas Citharel 2021-07-02 08:20:02 +00:00
parent b92a6e5ffc b196719238
commit ed0408d3bf
2 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
lib/web/plugs/http_security_plug.ex
View file

@ -51,8 +51,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
# Connect-src is available for any origin (*) because of webfinger query to redirect to content
@connect_src "connect-src 'self' * blob: "
# unsafe-eval is because of JS issues with regenerator-runtime
# unsafe-inline will be overriten in prod with sha256 hash
@script_src "script-src 'self' 'unsafe-eval' 'unsafe-inline' "
@script_src "script-src 'self' 'unsafe-eval' "
@style_src "style-src 'self' "
@font_src "font-src 'self' "
@ -76,7 +75,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
script_src =
if Config.get(:env) == :dev do
@script_src
[@script_src, "'unsafe-inline' "]
else
[
@script_src,

2
test/web/plugs/http_security_plug_test.exs
View file

@ -73,7 +73,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do
[csp] = Conn.get_resp_header(conn, "content-security-policy")
assert csp =~
~r/script-src 'self' 'unsafe-eval' 'unsafe-inline' 'sha256-[\w+\/=]*' example.com matomo.example.com;/
~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' example.com matomo.example.com;/
end
end