summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorErik Michelson2021-03-29 23:35:12 +0200
committerErik Michelson2021-03-29 23:35:12 +0200
commitf948de1d48e9daa2181e23fc0f7136f75210acaf (patch)
treeb18bb71222b93b3d485cddc2808666f04bf5a2c9 /lib
parent1534d7029bf82c74d5b927e8b179a763ccb1cae4 (diff)
Remove yahoo domain from default CSP rules
Signed-off-by: Erik Michelson <opensource@erik.michelson.eu>
Diffstat (limited to 'lib')
-rw-r--r--lib/csp.js2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/csp.js b/lib/csp.js
index 616c1d21..108f2a22 100644
--- a/lib/csp.js
+++ b/lib/csp.js
@@ -5,7 +5,7 @@ const CspStrategy = {}
const defaultDirectives = {
defaultSrc: ['\'self\''],
- scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', 'https://query.yahooapis.com', '\'unsafe-eval\''],
+ scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', '\'unsafe-eval\''],
// ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594
imgSrc: ['*'],
styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://github.githubassets.com'], // unsafe-inline is required for some libs, plus used in views