maxmustermann/vscode
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

Don't use 'self' for image editor csp

Browse source 
On desktop, we now serve webview resources from a different origin than the webview itself. This means we no longer can use `'self'` in our CSP as shorthand and instead should always use the provided `cspSource`
This commit is contained in:
Matt Bierner 2021-04-08 17:08:08 -07:00
parent 044a99585c
commit 9c9e188aa0
No known key found for this signature in database
GPG key ID: 099C331567E11888
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
extensions/image-preview/src/preview.ts
View file

@ -212,6 +212,7 @@ class Preview extends Disposable {
const nonce = Date.now().toString();
const cspSource = this.webviewEditor.webview.cspSource;
return /* html */`<!DOCTYPE html>
<html lang="en">
<head>
@ -225,7 +226,7 @@ class Preview extends Disposable {
<link rel="stylesheet" href="${escapeAttribute(this.extensionResource('/media/main.css'))}" type="text/css" media="screen" nonce="${nonce}">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' data: ${this.webviewEditor.webview.cspSource}; script-src 'nonce-${nonce}'; style-src 'self' 'nonce-${nonce}';">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src data: ${cspSource}; script-src 'nonce-${nonce}'; style-src ${cspSource} 'nonce-${nonce}';">
<meta id="image-preview-settings" data-settings="${escapeAttribute(JSON.stringify(settings))}">
</head>
<body class="container image scale-to-fit loading">