From eb9a7e36260c99aec980d097ee819c17ebb93631 Mon Sep 17 00:00:00 2001 From: Yamagishi Kazutoshi Date: Tue, 15 Mar 2022 03:20:40 +0900 Subject: [PATCH] Fix LetterOpennerWeb CSP (#17770) --- config/initializers/content_security_policy.rb | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/config/initializers/content_security_policy.rb b/config/initializers/content_security_policy.rb index b377b7b4d..c113b0f8b 100644 --- a/config/initializers/content_security_policy.rb +++ b/config/initializers/content_security_policy.rb @@ -60,4 +60,20 @@ Rails.application.reloader.to_prepare do PgHero::HomeController.after_action do request.content_security_policy_nonce_generator = nil end + + if Rails.env.development? + LetterOpenerWeb::LettersController.content_security_policy do |p| + p.child_src :self + p.connect_src :none + p.frame_ancestors :self + p.frame_src :self + p.script_src :unsafe_inline + p.style_src :unsafe_inline + p.worker_src :none + end + + LetterOpenerWeb::LettersController.after_action do |p| + request.content_security_policy_nonce_directives = %w(script-src) + end + end end