gsadmin/gitbook
1
0
Fork 0
mirror of https://github.com/GitbookIO/gitbook.git synced 2026-09-20 01:25:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

Use an assetPrefix to serve all assets from same URLs (#172)

Browse Source 
* Test an assetPrefix

* Fix condition

* Use the env instead

* Use it for CSP
This commit is contained in:
Samy Pessé
2024-02-19 16:32:33 +01:00
committed by GitHub
parent 9b285625d9
commit 6bd6ddd031
3 changed files with 17 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/lib/csp.ts
+12 -8
View File
@@ -4,6 +4,10 @@ import { headers } from 'next/headers';
import { filterOutNullable } from './typescript';
const assetsDomain = process.env.GITBOOK_ASSETS_PREFIX
? new URL(process.env.GITBOOK_ASSETS_PREFIX).host
: undefined;
/**
* Get the current nonce for the current request.
*/
@@ -34,16 +38,16 @@ export function getContentSecurityPolicy(scripts: SpaceIntegrationScript[], nonc
//
// Since I can't get the nonce to work for inline styles, we need to allow unsafe-inline
const defaultCSP = `
default-src 'self';
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' integrations.gitbook.com https://cdn.iframe.ly;
style-src 'self' fonts.googleapis.com 'unsafe-inline';
img-src * 'self' blob: data: files.gitbook.com;
connect-src * 'self' integrations.gitbook.com app.gitbook.com;
font-src 'self' fonts.gstatic.com;
default-src 'self' ${assetsDomain};
script-src 'self' 'nonce-${nonce}' 'strict-dynamic' 'unsafe-inline' 'unsafe-eval' ${assetsDomain} integrations.gitbook.com https://cdn.iframe.ly;
style-src 'self' ${assetsDomain} fonts.googleapis.com 'unsafe-inline';
img-src * 'self' blob: data: files.gitbook.com ${assetsDomain};
connect-src * 'self' integrations.gitbook.com app.gitbook.com ${assetsDomain};
font-src 'self' fonts.gstatic.com ${assetsDomain};
frame-src *;
object-src 'none';
base-uri 'self';
form-action 'self';
base-uri 'self' ${assetsDomain};
form-action 'self' ${assetsDomain};
frame-ancestors 'none';
`;