gsadmin/gitbook
1
0
Fork 0
mirror of https://github.com/GitbookIO/gitbook.git synced 2026-09-16 23:55:20 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use an assetPrefix to serve all assets from same URLs (#172)

Browse Source 
* Test an assetPrefix

* Fix condition

* Use the env instead

* Use it for CSP
This commit is contained in:
Samy Pessé
2024-02-19 16:32:33 +01:00
committed by GitHub
parent 9b285625d9
commit 6bd6ddd031
3 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/ci.yaml
+2
View File
@@ -30,6 +30,8 @@ jobs:
- name: Sets env vars for production
run: |
echo "SENTRY_ENVIRONMENT=production" >> $GITHUB_ENV
echo "GITBOOK_ASSETS_PREFIX=https://open.gitbook.com" >> $GITHUB_ENV
if: startsWith(github.ref, 'refs/tags/main')
- name: Sets env vars for preview
run: |
echo "SENTRY_ENVIRONMENT=preview" >> $GITHUB_ENV
next.config.js
+3
View File
@@ -6,6 +6,7 @@ module.exports = withSentryConfig(
BUILD_VERSION: (process.env.GITHUB_SHA ?? '').slice(0, 7),
SENTRY_DSN: process.env.SENTRY_DSN ?? '',
SENTRY_ENVIRONMENT: process.env.SENTRY_ENVIRONMENT ?? 'development',
GITBOOK_ASSETS_PREFIX: process.env.GITBOOK_ASSETS_PREFIX,
},
webpack(config) {
@@ -20,6 +21,8 @@ module.exports = withSentryConfig(
return config;
},
assetPrefix: process.env.GITBOOK_ASSETS_PREFIX,
},
{
silent: true,
src/lib/csp.ts
+12 -8
View File
@@ -4,6 +4,10 @@ import { headers } from 'next/headers';
import { filterOutNullable } from './typescript';
const assetsDomain = process.env.GITBOOK_ASSETS_PREFIX
? new URL(process.env.GITBOOK_ASSETS_PREFIX).host
: undefined;
/**
* Get the current nonce for the current request.
*/
@@ -34,16 +38,16 @@ export function getContentSecurityPolicy(scripts: SpaceIntegrationScript[], nonc
//
// Since I can't get the nonce to work for inline styles, we need to allow unsafe-inline
const defaultCSP = `
default-src 'self';
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' integrations.gitbook.com https://cdn.iframe.ly;
style-src 'self' fonts.googleapis.com 'unsafe-inline';
img-src * 'self' blob: data: files.gitbook.com;
connect-src * 'self' integrations.gitbook.com app.gitbook.com;
font-src 'self' fonts.gstatic.com;
default-src 'self' ${assetsDomain};
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' ${assetsDomain} integrations.gitbook.com https://cdn.iframe.ly;
style-src 'self' ${assetsDomain} fonts.googleapis.com 'unsafe-inline';
img-src * 'self' blob: data: files.gitbook.com ${assetsDomain};
connect-src * 'self' integrations.gitbook.com app.gitbook.com ${assetsDomain};
font-src 'self' fonts.gstatic.com ${assetsDomain};
frame-src *;
object-src 'none';
base-uri 'self';
form-action 'self';
base-uri 'self' ${assetsDomain};
form-action 'self' ${assetsDomain};
frame-ancestors 'none';
`;