depau/HackMD
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #985 from SISheogorath/fix/helmetCSP

Browse source 
Add `data:` URL to CSP and upgrade helmet
This commit is contained in:
Christoph (Sheogorath) Kern 2018-10-11 00:19:24 +02:00 committed by GitHub
commit 763b000bc6
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
lib/csp.js
View file

@ -9,7 +9,7 @@ var defaultDirectives = {
// ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594 // ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594
imgSrc: ['*'], imgSrc: ['*'],
styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views
fontSrc: ['\'self\'', 'https://public.slidesharecdn.com'], fontSrc: ['\'self\'', 'data:', 'https://public.slidesharecdn.com'],
objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/ objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/
mediaSrc: ['*'], mediaSrc: ['*'],
childSrc: ['*'], childSrc: ['*'],

2
package.json
View file

@ -47,7 +47,7 @@
"gist-embed": "~2.6.0", "gist-embed": "~2.6.0",
"graceful-fs": "^4.1.11", "graceful-fs": "^4.1.11",
"handlebars": "^4.0.6", "handlebars": "^4.0.6",
"helmet": "^3.3.0", "helmet": "^3.13.0",
"highlight.js": "~9.12.0", "highlight.js": "~9.12.0",
"i18n": "^0.8.3", "i18n": "^0.8.3",
"imgur": "git+https://github.com/hackmdio/node-imgur.git", "imgur": "git+https://github.com/hackmdio/node-imgur.git",