Chapril/mobilizon.chapril.org-mobilizon
Chapril
/
mobilizon.chapril.org-mobilizon
24
0
Fork 0
Code Issues Pull Requests Releases Activity

Remove unsafe-inline from CSP 

Signed-off-by: Thomas Citharel <tcit@tcit.fr>
This commit is contained in:
Thomas Citharel 2021-07-01 18:30:34 +02:00
parent b92a6e5ffc
commit b196719238
No known key found for this signature in database
GPG Key ID: A061B9DDE0CA0773
2 changed files with 3 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
lib/web/plugs/http_security_plug.ex
View File

@ -51,8 +51,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
# Connect-src is available for any origin (*) because of webfinger query to redirect to content
@connect_src "connect-src 'self' * blob: "
# unsafe-eval is because of JS issues with regenerator-runtime
# unsafe-inline will be overriten in prod with sha256 hash
@script_src "script-src 'self' 'unsafe-eval' 'unsafe-inline' "
@script_src "script-src 'self' 'unsafe-eval' "
@style_src "style-src 'self' "
@font_src "font-src 'self' "
@ -76,7 +75,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlug do
script_src =
if Config.get(:env) == :dev do
@script_src
[@script_src, "'unsafe-inline' "]
else
[
@script_src,

2
test/web/plugs/http_security_plug_test.exs
View File

@ -73,7 +73,7 @@ defmodule Mobilizon.Web.Plugs.HTTPSecurityPlugTest do
[csp] = Conn.get_resp_header(conn, "content-security-policy")
assert csp =~
~r/script-src 'self' 'unsafe-eval' 'unsafe-inline' 'sha256-[\w+\/=]*' example.com matomo.example.com;/
~r/script-src 'self' 'unsafe-eval' 'sha256-[\w+\/=]*' example.com matomo.example.com;/
end
end