diff options
| author | Christoph (Sheogorath) Kern | 2018-10-11 00:19:24 +0200 |
|---|---|---|
| committer | GitHub | 2018-10-11 00:19:24 +0200 |
| commit | 763b000bc61002e5100e04f0f04581493d3cba83 (patch) | |
| tree | 14ac4623e1f6a5f170d066b03fa1c5979a2ff11a /lib/csp.js | |
| parent | 4bce4b16356f0538b8c9425a02aeb9ab7f1eacf8 (diff) | |
| parent | d4a9bb3c7e090f5fbea4df596be0c6261b3b4ac3 (diff) | |
Merge pull request #985 from SISheogorath/fix/helmetCSP
Add `data:` URL to CSP and upgrade helmet
Diffstat (limited to 'lib/csp.js')
| -rw-r--r-- | lib/csp.js | 2 |
1 files changed, 1 insertions, 1 deletions
@@ -9,7 +9,7 @@ var defaultDirectives = { // ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594 imgSrc: ['*'], styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://assets-cdn.github.com'], // unsafe-inline is required for some libs, plus used in views - fontSrc: ['\'self\'', 'https://public.slidesharecdn.com'], + fontSrc: ['\'self\'', 'data:', 'https://public.slidesharecdn.com'], objectSrc: ['*'], // Chrome PDF viewer treats PDFs as objects :/ mediaSrc: ['*'], childSrc: ['*'], |