Miroirs/devdocs
1
0
Fork 0
mirror of https://github.com/freeCodeCamp/devdocs synced 2024-11-16 19:48:10 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Ban inline scripts in CSP

Browse source
This commit is contained in:
Thibaut Courouble 2016-06-04 11:15:30 -04:00
parent bdda2fbfe6
commit d8c2da09d1
2 changed files with 4 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
assets/javascripts/views/pages/jquery.coffee
View file

@ -45,7 +45,7 @@ class app.views.JqueryPage extends app.views.BasePage
fixIframeSource: (source) -> fixIframeSource: (source) ->
source = source.replace '"/resources/', '"https://api.jquery.com/resources/' # attr(), keydown() source = source.replace '"/resources/', '"https://api.jquery.com/resources/' # attr(), keydown()
source.replace '</head>', """ source = source.replace '</head>', """
<style> <style>
html, body { border: 0; margin: 0; padding: 0; } html, body { border: 0; margin: 0; padding: 0; }
body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; } body { font-family: 'Helvetica Neue', Helvetica, Arial, sans-serif; }
@ -60,3 +60,4 @@ class app.views.JqueryPage extends app.views.BasePage
</script> </script>
</head> </head>
""" """
source.replace /<script>/gi, '<script nonce="devdocs">'

4
lib/app.rb
View file

@ -67,13 +67,13 @@ class App < Sinatra::Application
BetterErrors.application_root = File.expand_path('..', __FILE__) BetterErrors.application_root = File.expand_path('..', __FILE__)
BetterErrors.editor = :sublime BetterErrors.editor = :sublime
set :csp, "default-src 'self' *; script-src 'self' 'unsafe-inline' *; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;" set :csp, "default-src 'self' *; script-src 'self' 'nonce-devdocs' *; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
end end
configure :production do configure :production do
set :static, false set :static, false
set :docs_host, '//docs.devdocs.io' set :docs_host, '//docs.devdocs.io'
set :csp, "default-src 'self' *; script-src 'self' 'unsafe-inline' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;" set :csp, "default-src 'self' *; script-src 'self' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src data:; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;"
use Rack::ConditionalGet use Rack::ConditionalGet
use Rack::ETag use Rack::ETag