mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-27 16:06:48 +09:00
Jeremy Daer
681bd78ea2
Uploads are served from this origin too, so script-src 'self' would run one
that a cache still holds under a script type from before the upload guard.
Application pages now allow each importmap URL up to its asset directory
(relative root and asset host included), the inline importmap by hash, and
the service worker by worker-src.
(cherry picked from commit 2be2227f40)
22 lines
940 B
Ruby
22 lines
940 B
Ruby
# Enforcing baseline policy. Application pages narrow script-src from this
|
|
# origin to its asset directory, since uploads are served from this origin
|
|
# too, and allow the two inline scripts the importmap helper emits by hash
|
|
# (InlineScriptHashes). There is no per-request nonce, so rendered HTML stays
|
|
# cacheable. 'self' remains for responses outside ApplicationController, none
|
|
# of which render user content.
|
|
#
|
|
# Nothing else is restricted: images, media, fonts, styles (including an
|
|
# account's custom styles) and connections behave as before.
|
|
#
|
|
# DISABLE_CONTENT_SECURITY_POLICY=true is the escape hatch for an install whose
|
|
# proxy or customization injects scripts the policy would block.
|
|
unless ENV["DISABLE_CONTENT_SECURITY_POLICY"] == "true"
|
|
Rails.application.configure do
|
|
config.content_security_policy do |policy|
|
|
policy.script_src :self
|
|
policy.object_src :none
|
|
policy.base_uri :self
|
|
end
|
|
end
|
|
end
|