Miroirs/devdocs
1
0
Fork 0
mirror of https://github.com/freeCodeCamp/devdocs synced 2024-11-16 19:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Ban inline scripts in CSP

Browse source
This commit is contained in:
Thibaut Courouble 2016-06-04 11:15:30 -04:00
parent bdda2fbfe6
commit d8c2da09d1
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
assets/javascripts/views/pages/jquery.coffee
View file

@ -45,7 +45,7 @@ class app.views.JqueryPage extends app.views.BasePage
fixIframeSource: (source) ->
source = source.replace '"/resources/', '"https://api.jquery.com/resources/' # attr(), keydown()
source.replace '</head>', """
source = source.replace '</head>', """
<style>
html, body { border: 0; margin: 0; padding: 0; }
body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; }
@ -60,3 +60,4 @@ class app.views.JqueryPage extends app.views.BasePage
</script>
</head>
"""
source.replace /<script>/gi, '<script nonce="devdocs">'

4
lib/app.rb
View file

@ -67,13 +67,13 @@ class App < Sinatra::Application
BetterErrors.application_root = File.expand_path('..', __FILE__)
BetterErrors.editor = :sublime
set :csp, "default-src 'self' *; script-src 'self' 'unsafe-inline' *; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
set :csp, "default-src 'self' *; script-src 'self' 'nonce-devdocs' *; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
end
configure :production do
set :static, false
set :docs_host, '//docs.devdocs.io'
set :csp, "default-src 'self' *; script-src 'self' 'unsafe-inline' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
set :csp, "default-src 'self' *; script-src 'self' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
use Rack::ConditionalGet
use Rack::ETag