Jeremy Daer c3616f81b4 Enforce a script policy that allows the importmap by hash ...

script-src 'self', object-src 'none' and base-uri 'self', enforced. The
two inline scripts the importmap helper emits are allowed by their
SHA-256, and the origins its URLs point to (a configured asset host, in
any form Rails accepts) are allowed by name. There is no per-request
nonce, so cached pages stay valid.

DISABLE_CONTENT_SECURITY_POLICY=true leaves the policy off, for an
install whose proxy or customization injects scripts.

(cherry picked from commit 562888251e)

Backport: 1.5.2 has no response cache, so the cached-page test is left out.

2026-10-17 00:47:32 -07:00

..

content_security_policy_test.rb

Enforce a script policy that allows the importmap by hash

2026-10-17 00:47:32 -07:00