bterkuile/fizzy
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Tune CSP for user extensions and close implicit-allow gaps (#1974)

Browse Source 
Loosen font-src and add media-src to allow browser extensions like
accessibility fonts (OpenDyslexic) and user style managers to work
without CSP violations.

Add default-src and connect-src directives to close security gaps where
unspecified directives were implicitly allowing all sources.
This commit is contained in:
Jeremy Daer
2025-12-05 16:57:03 -08:00
committed by GitHub
parent 6006491ab4
commit 345f457513
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
config/initializers/content_security_policy.rb
+4 -1
View File
@@ -13,10 +13,13 @@ Rails.application.configure do
config.content_security_policy_nonce_directives = %w[ script-src ]
config.content_security_policy do |policy|
policy.default_src :self
policy.script_src :self
policy.style_src :self, :unsafe_inline
policy.connect_src :self
policy.img_src :self, "blob:", "data:", "https:"
policy.font_src :self
policy.font_src :self, "data:", "https:"
policy.media_src :self, "blob:", "data:", "https:"
policy.object_src :none
policy.base_uri :none