github/hedgedoc
1
0
Fork 0
mirror of https://github.com/hedgedoc/hedgedoc.git synced 2024-11-25 11:16:31 -05:00
Code Issues Projects Releases Packages Wiki Activity

Merge pull request #1369 from hedgedoc/feature/remove_unsafe_eval

Browse source
This commit is contained in:
Yannick Bungers 2021-06-08 22:16:07 +02:00 committed by GitHub
commit 1d082ae827
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 3 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
lib/csp.js
View file

@ -5,8 +5,7 @@ const CspStrategy = {}
const defaultDirectives = { const defaultDirectives = {
defaultSrc: ['\'self\''], defaultSrc: ['\'self\''],
scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net', '\'unsafe-eval\''], scriptSrc: ['\'self\'', 'vimeo.com', 'https://gist.github.com', 'www.slideshare.net'],
// ^ TODO: Remove unsafe-eval - webpack script-loader issues https://github.com/hackmdio/codimd/issues/594
imgSrc: ['*'], imgSrc: ['*'],
styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://github.githubassets.com'], // unsafe-inline is required for some libs, plus used in views styleSrc: ['\'self\'', '\'unsafe-inline\'', 'https://github.githubassets.com'], // unsafe-inline is required for some libs, plus used in views
fontSrc: ['\'self\'', 'data:', 'https://public.slidesharecdn.com'], fontSrc: ['\'self\'', 'data:', 'https://public.slidesharecdn.com'],

4
webpack.dev.js
View file

@ -6,9 +6,9 @@ module.exports = [
// merge common config // merge common config
merge(common, { merge(common, {
mode: 'development', mode: 'development',
devtool: 'eval-cheap-module-source-map' devtool: 'cheap-module-source-map'
}), }),
merge(htmlexport, { merge(htmlexport, {
mode: 'development', mode: 'development',
devtool: 'eval-cheap-module-source-map' devtool: 'cheap-module-source-map'
})] })]