Ban inline scripts in CSP

Thibaut Courouble committed 10 years ago

Commit d8c2da01 parent bdda2fb2 files · +4 −3Browse files

Unified · Split

2 files

assets/javascripts/views/pages/jquery.coffee +2 −1
lib/app.rb +2 −2

assets/javascripts/views/pages/jquery.coffee+2−1

@@ -45,7 +45,7 @@ class app.views.JqueryPage extends app.views.BasePage · 44 unmodified lines
45	45
46	46	fixIframeSource: (source) ->
47	47	source = source.replace '"/resources/', '"https://api.jquery.com/resources/' # attr(), keydown()
48		− source.replace '</head>', """
	48	+ source = source.replace '</head>', """
49	49	<style>
50	50	html, body { border: 0; margin: 0; padding: 0; }
51	51	body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; }
@@ -60,3 +60,4 @@ class app.views.JqueryPage extends app.views.BasePage · 8 unmodified lines
60	60	</script>
61	61	</head>
62	62	"""
	63	+ source.replace /<script>/gi, '<script nonce="devdocs">'

lib/app.rb+2−2

@@ -67,13 +67,13 @@ class App < Sinatra::Application · 66 unmodified lines
67	67	BetterErrors.application_root = File.expand_path('..', __FILE__)
68	68	BetterErrors.editor = :sublime
69	69
70		− set :csp, "default-src 'self' ; script-src 'self' 'unsafe-inline' ; font-src data:; style-src 'self' 'unsafe-inline' ; img-src 'self' data:;"
	70	+ set :csp, "default-src 'self' ; script-src 'self' 'nonce-devdocs' ; font-src data:; style-src 'self' 'unsafe-inline' ; img-src 'self' data:;"
71	71	end
72	72
73	73	configure :production do
74	74	set :static, false
75	75	set :docs_host, '//docs.devdocs.io'
76		− set :csp, "default-src 'self' ; script-src 'self' 'unsafe-inline' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://.jquery.com https://.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' ; img-src 'self' * data:;"
	76	+ set :csp, "default-src 'self' ; script-src 'self' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://.jquery.com https://.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' ; img-src 'self' * data:;"
77	77
78	78	use Rack::ConditionalGet
79	79	use Rack::ETag