chore: add csp to allow script executions from only self and installe…

…d extensions
phcode-dev · Oct 6, 2023 · 4b34784 · 4b34784
1 parent b7de616
commit 4b34784
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 1 deletion.
diff --git a/src/index.html b/src/index.html
@@ -25,6 +25,8 @@
 <html lang="en">
 <head id="main-scripts-head">
     <meta charset="utf-8">
+    <meta http-equiv="Content-Security-Policy"
+          content="default-src 'self' 'unsafe-inline' 'unsafe-eval' asset: https://asset.localhost https://storage.googleapis.com; img-src *; media-src *; frame-src *; connect-src *; font-src *;">
     <meta name= "viewport" content="width=device-width, user-scalable=no" />
     <meta name="theme-color" content="#47484B">
     <link rel="apple-touch-icon" sizes="180x180" href="styles/images/favicons/apple-touch-icon.png">

diff --git a/test/SpecRunner.html b/test/SpecRunner.html
@@ -23,7 +23,8 @@
 <html lang="en">
 <head>
   <title>Jasmine Spec Runner</title>
-
+  <meta http-equiv="Content-Security-Policy"
+        content="default-src 'self' 'unsafe-inline' 'unsafe-eval' asset: https://asset.localhost https://storage.googleapis.com; img-src *; media-src *; frame-src *; connect-src *; font-src *;">
   <script type="text/javascript">
     //brackets.app.showDeveloperTools();
     console.warn('Make sure to run this following command before starting tests : npm run build ');