History

Ban inline scripts in CSP

Thibaut Courouble committed 10 years ago

Commit d8c2da01 parent bdda2fb2 files · +4 −3Browse files

Unified · Split

2 files
  1. assets/javascripts/views/pages/jquery.coffee +2 −1
  2. lib/app.rb +2 −2
assets/javascripts/views/pages/jquery.coffee+2−1
@@ -45,7 +45,7 @@ class app.views.JqueryPage extends app.views.BasePage · 44 unmodified lines
45 45
46 fixIframeSource: (source) ->46 fixIframeSource: (source) ->
47 source = source.replace '"/resources/', '"https://api.jquery.com/resources/' # attr(), keydown()47 source = source.replace '"/resources/', '"https://api.jquery.com/resources/' # attr(), keydown()
48 source.replace '</head>', """48 source = source.replace '</head>', """
49 <style>49 <style>
50 html, body { border: 0; margin: 0; padding: 0; }50 html, body { border: 0; margin: 0; padding: 0; }
51 body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; }51 body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; }
@@ -60,3 +60,4 @@ class app.views.JqueryPage extends app.views.BasePage · 8 unmodified lines
60 </script>60 </script>
61 </head>61 </head>
62 """62 """
63 source.replace /<script>/gi, '<script nonce="devdocs">'
lib/app.rb+2−2
@@ -67,13 +67,13 @@ class App < Sinatra::Application · 66 unmodified lines
67 BetterErrors.application_root = File.expand_path('..', __FILE__)67 BetterErrors.application_root = File.expand_path('..', __FILE__)
68 BetterErrors.editor = :sublime68 BetterErrors.editor = :sublime
69 69
70 set :csp, "default-src 'self' *; script-src 'self' 'unsafe-inline' *; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"70 set :csp, "default-src 'self' *; script-src 'self' 'nonce-devdocs' *; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
71 end71 end
72 72
73 configure :production do73 configure :production do
74 set :static, false74 set :static, false
75 set :docs_host, '//docs.devdocs.io'75 set :docs_host, '//docs.devdocs.io'
76 set :csp, "default-src 'self' *; script-src 'self' 'unsafe-inline' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"76 set :csp, "default-src 'self' *; script-src 'self' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
77 77
78 use Rack::ConditionalGet78 use Rack::ConditionalGet
79 use Rack::ETag79 use Rack::ETag