Robin-van-der-Linde/MapComplete
1
0
Fork 0
forked from MapComplete/MapComplete
Code Pull requests Activity

Fix: properly add 'self' to connect-src (take 2)

Browse source
This commit is contained in:
Pieter Vander Vennet 2024-02-07 18:02:35 +01:00
parent 441a9a5ed9
commit c823e745a3
1 changed files with 1 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
scripts/generateLayouts.ts
View file

@ -273,7 +273,6 @@ async function generateCsp(
} }
): Promise<string> { ): Promise<string> {
const apiUrls: string[] = [ const apiUrls: string[] = [
"'self'",
...Constants.defaultOverpassUrls, ...Constants.defaultOverpassUrls,
Constants.countryCoderEndpoint, Constants.countryCoderEndpoint,
Constants.nominatimEndpoint, Constants.nominatimEndpoint,
@ -350,7 +349,7 @@ async function generateCsp(
"default-src": "'self'", "default-src": "'self'",
"child-src": "'self' blob: ", "child-src": "'self' blob: ",
"img-src": "* data:", // maplibre depends on 'data:' to load "img-src": "* data:", // maplibre depends on 'data:' to load
"connect-src": "self "+connectSrc.join(" "), "connect-src": "'self' "+connectSrc.join(" "),
"report-to": "https://report.mapcomplete.org/csp", "report-to": "https://report.mapcomplete.org/csp",
"worker-src": "'self' blob:", // Vite somehow loads the worker via a 'blob' "worker-src": "'self' blob:", // Vite somehow loads the worker via a 'blob'
"style-src": "'self' 'unsafe-inline'", // unsafe-inline is needed to change the default background pin colours "style-src": "'self' 'unsafe-inline'", // unsafe-inline is needed to change the default background pin colours