gsadmin/meet
1
0
Fork 0
mirror of https://github.com/suitenumerique/meet.git synced 2026-07-28 04:39:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

🩹(frontend) fix missing default-src in CSP configuration

Browse Source 
The CSP was missing a default-src directive (flagged by CodeRabbit).
Without it, styles, images, fonts, and media are completely
unrestricted, which undercuts the otherwise strict policy.

Set default-src to 'self' and add an explicit style-src directive
since we rely on inline styles (e.g. #close-msg and the view
toggling use inline style attributes), so style-src needs to allow
'self' and 'unsafe-inline'.
This commit is contained in:
lebaudantoine
2026-06-11 14:43:35 +02:00
committed by aleb_the_flash
parent 6d06aee92d
commit 69a6dd1463
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docker/dinum-frontend/nginx/default.conf
+1 -1
View File
@@ -48,7 +48,7 @@ server {
set $nonce $request_id;
set $csp "upgrade-insecure-requests; ";
set $csp "default-src 'self'; upgrade-insecure-requests; ";
set $csp "${csp}frame-ancestors ${ms_domains}; ";
set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
set $csp "${csp}connect-src 'self' ${ms_domains}; ";
src/helm/extra/templates/frontend_nginx_cm.yaml
+1 -1
View File
@@ -56,7 +56,7 @@ data:
set $nonce $request_id;
set $csp "upgrade-insecure-requests; ";
set $csp "default-src 'self'; upgrade-insecure-requests; ";
set $csp "${csp}frame-ancestors ${ms_domains}; ";
set $csp "${csp}script-src 'nonce-${nonce}' 'strict-dynamic'; ";
set $csp "${csp}connect-src 'self' ${ms_domains}; ";