mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-10-27 16:06:48 +09:00
Jeremy Daer
c3616f81b4
script-src 'self', object-src 'none' and base-uri 'self', enforced. The
two inline scripts the importmap helper emits are allowed by their
SHA-256, and the origins its URLs point to (a configured asset host, in
any form Rails accepts) are allowed by name. There is no per-request
nonce, so cached pages stay valid.
DISABLE_CONTENT_SECURITY_POLICY=true leaves the policy off, for an
install whose proxy or customization injects scripts.
(cherry picked from commit 562888251e)
Backport: 1.5.2 has no response cache, so the cached-page test is left out.
19 lines
755 B
Ruby
19 lines
755 B
Ruby
# Enforcing baseline policy. Scripts run only from this origin; the two inline
|
|
# scripts the importmap helper emits are allowed by hash (InlineScriptHashes),
|
|
# so there is no per-request nonce and rendered HTML stays cacheable.
|
|
#
|
|
# Nothing else is restricted: images, media, fonts, styles (including an
|
|
# account's custom styles) and connections behave as before.
|
|
#
|
|
# DISABLE_CONTENT_SECURITY_POLICY=true is the escape hatch for an install whose
|
|
# proxy or customization injects scripts the policy would block.
|
|
unless ENV["DISABLE_CONTENT_SECURITY_POLICY"] == "true"
|
|
Rails.application.configure do
|
|
config.content_security_policy do |policy|
|
|
policy.script_src :self
|
|
policy.object_src :none
|
|
policy.base_uri :self
|
|
end
|
|
end
|
|
end
|