matrix/element-web
1
0
Fork 0
mirror of https://github.com/element-hq/element-web.git synced 2025-12-02 21:22:41 +03:00
Code Activity

Improve Content-Security-Policy (#25210)

Browse Source
This commit is contained in:
Michael Telatynski
2023-04-26 14:49:35 +01:00
committed by GitHub
parent 59b6285458
commit afab95288e
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/vector/index.html
View File

@@ -26,7 +26,7 @@
<meta http-equiv="Content-Security-Policy" content="
default-src 'none';
style-src 'self' 'unsafe-inline' <%= csp_extra_source %>;
script-src 'self' 'unsafe-eval' https://www.recaptcha.net https://www.gstatic.com <%= csp_extra_source %>;
script-src 'self' 'wasm-unsafe-eval' https://www.recaptcha.net/recaptcha/ https://www.gstatic.com/recaptcha/ <%= csp_extra_source %>;
img-src * blob: data:;
connect-src *;
font-src 'self' data: <%= csp_extra_source %>;

4
webpack.config.js
View File

@@ -99,8 +99,8 @@ module.exports = (env, argv) => {
const development = {};
if (devMode) {
// High quality, embedded source maps for dev builds
development["devtool"] = "eval-source-map";
// Embedded source maps for dev builds, can't use eval-source-map due to CSP
development["devtool"] = "inline-source-map";
} else {
if (process.env.CI_PACKAGE) {
// High quality source maps in separate .map files which include the source. This doesn't bulk up the .js