summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorChristoph (Sheogorath) Kern2018-10-11 00:19:24 +0200
committerGitHub2018-10-11 00:19:24 +0200
commit763b000bc61002e5100e04f0f04581493d3cba83 (patch)
tree14ac4623e1f6a5f170d066b03fa1c5979a2ff11a
parent4bce4b16356f0538b8c9425a02aeb9ab7f1eacf8 (diff)
parentd4a9bb3c7e090f5fbea4df596be0c6261b3b4ac3 (diff)
Merge pull request #985 from SISheogorath/fix/helmetCSP
Add `data:` URL to CSP and upgrade helmet
Diffstat (limited to '')
-rw-r--r--lib/csp.js2
-rw-r--r--package.json2
2 files changed, 2 insertions, 2 deletions
diff --git a/lib/csp.js b/lib/csp.js
index 0987df85..96be533a 100644
--- a/lib/csp.js
+++ b/lib/csp.js
@@ -9,7 +9,7 @@ var defaultDirectives = {
// ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594
imgSrc: ['*'],
styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views
- fontSrc: ['\'self\'', 'https://public.slidesharecdn.com'],
+ fontSrc: ['\'self\'', 'data:', 'https://public.slidesharecdn.com'],
objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/
mediaSrc: ['*'],
childSrc: ['*'],
diff --git a/package.json b/package.json
index b0a906db..a887ada1 100644
--- a/package.json
+++ b/package.json
@@ -47,7 +47,7 @@
"gist-embed": "~2.6.0",
"graceful-fs": "^4.1.11",
"handlebars": "^4.0.6",
- "helmet": "^3.3.0",
+ "helmet": "^3.13.0",
"highlight.js": "~9.12.0",
"i18n": "^0.8.3",
"imgur": "git+https://github.com/hackmdio/node-imgur.git",