mirror of
https://github.com/Microsoft/vscode
synced 2024-08-27 13:00:58 +00:00
csp - tighten rules and update trusted types (#178675)
* csp - tighten rules and update trusted types * bring back `https:` for `img-src` * also update others
This commit is contained in:
parent
f82fef56ec
commit
4a21266bdd
|
@ -3,7 +3,31 @@
|
|||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
|
||||
<meta
|
||||
http-equiv="Content-Security-Policy"
|
||||
content="
|
||||
default-src
|
||||
'none'
|
||||
;
|
||||
img-src
|
||||
'self'
|
||||
data:
|
||||
;
|
||||
script-src
|
||||
'self'
|
||||
;
|
||||
style-src
|
||||
'self'
|
||||
'unsafe-inline'
|
||||
;
|
||||
connect-src
|
||||
'self'
|
||||
https:
|
||||
;
|
||||
font-src
|
||||
'self'
|
||||
;
|
||||
">
|
||||
<style>
|
||||
body {
|
||||
display: none
|
||||
|
|
|
@ -3,7 +3,31 @@
|
|||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
|
||||
<meta
|
||||
http-equiv="Content-Security-Policy"
|
||||
content="
|
||||
default-src
|
||||
'none'
|
||||
;
|
||||
img-src
|
||||
'self'
|
||||
data:
|
||||
;
|
||||
script-src
|
||||
'self'
|
||||
;
|
||||
style-src
|
||||
'self'
|
||||
'unsafe-inline'
|
||||
;
|
||||
connect-src
|
||||
'self'
|
||||
https:
|
||||
;
|
||||
font-src
|
||||
'self'
|
||||
;
|
||||
">
|
||||
<style>
|
||||
body {
|
||||
display: none
|
||||
|
|
|
@ -3,7 +3,31 @@
|
|||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
|
||||
<meta
|
||||
http-equiv="Content-Security-Policy"
|
||||
content="
|
||||
default-src
|
||||
'none'
|
||||
;
|
||||
img-src
|
||||
'self'
|
||||
data:
|
||||
;
|
||||
script-src
|
||||
'self'
|
||||
;
|
||||
style-src
|
||||
'self'
|
||||
'unsafe-inline'
|
||||
;
|
||||
connect-src
|
||||
'self'
|
||||
https:
|
||||
;
|
||||
font-src
|
||||
'self'
|
||||
;
|
||||
">
|
||||
</head>
|
||||
|
||||
<body aria-label="">
|
||||
|
|
|
@ -3,7 +3,31 @@
|
|||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
|
||||
<meta
|
||||
http-equiv="Content-Security-Policy"
|
||||
content="
|
||||
default-src
|
||||
'none'
|
||||
;
|
||||
img-src
|
||||
'self'
|
||||
data:
|
||||
;
|
||||
script-src
|
||||
'self'
|
||||
;
|
||||
style-src
|
||||
'self'
|
||||
'unsafe-inline'
|
||||
;
|
||||
connect-src
|
||||
'self'
|
||||
https:
|
||||
;
|
||||
font-src
|
||||
'self'
|
||||
;
|
||||
">
|
||||
</head>
|
||||
|
||||
<body aria-label="">
|
||||
|
|
|
@ -3,8 +3,62 @@
|
|||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data: blob: vscode-remote-resource:; media-src 'self'; frame-src 'self' vscode-webview:; object-src 'self'; script-src 'self' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ws:; font-src 'self' https: vscode-remote-resource:;">
|
||||
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; trusted-types amdLoader cellRendererEditorText defaultWorkerFactory diffEditorWidget stickyScrollViewLayer editorGhostText domLineBreaksComputer editorViewLayer diffReview dompurify notebookRenderer safeInnerHtml standaloneColorizer tokenizeToString;">
|
||||
<meta
|
||||
http-equiv="Content-Security-Policy"
|
||||
content="
|
||||
default-src
|
||||
'none'
|
||||
;
|
||||
img-src
|
||||
'self'
|
||||
data:
|
||||
blob:
|
||||
vscode-remote-resource:
|
||||
https:
|
||||
;
|
||||
media-src
|
||||
'self'
|
||||
;
|
||||
frame-src
|
||||
'self'
|
||||
vscode-webview:
|
||||
;
|
||||
script-src
|
||||
'self'
|
||||
'unsafe-eval'
|
||||
blob:
|
||||
;
|
||||
style-src
|
||||
'self'
|
||||
'unsafe-inline'
|
||||
;
|
||||
connect-src
|
||||
'self'
|
||||
https:
|
||||
ws:
|
||||
;
|
||||
font-src
|
||||
'self'
|
||||
vscode-remote-resource:
|
||||
;
|
||||
require-trusted-types-for
|
||||
'script'
|
||||
;
|
||||
trusted-types
|
||||
amdLoader
|
||||
cellRendererEditorText
|
||||
defaultWorkerFactory
|
||||
diffEditorWidget
|
||||
diffReview
|
||||
domLineBreaksComputer
|
||||
dompurify
|
||||
editorGhostText
|
||||
editorViewLayer
|
||||
notebookRenderer
|
||||
stickyScrollViewLayer
|
||||
tokenizeToString
|
||||
;
|
||||
"/>
|
||||
</head>
|
||||
|
||||
<body aria-label="">
|
||||
|
|
|
@ -3,8 +3,62 @@
|
|||
<html>
|
||||
<head>
|
||||
<meta charset="utf-8" />
|
||||
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data: blob: vscode-remote-resource:; media-src 'self'; frame-src 'self' vscode-webview:; object-src 'self'; script-src 'self' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ws:; font-src 'self' https: vscode-remote-resource:;">
|
||||
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; trusted-types amdLoader cellRendererEditorText defaultWorkerFactory diffEditorWidget stickyScrollViewLayer editorGhostText domLineBreaksComputer editorViewLayer diffReview dompurify notebookRenderer safeInnerHtml standaloneColorizer tokenizeToString;">
|
||||
<meta
|
||||
http-equiv="Content-Security-Policy"
|
||||
content="
|
||||
default-src
|
||||
'none'
|
||||
;
|
||||
img-src
|
||||
'self'
|
||||
data:
|
||||
blob:
|
||||
vscode-remote-resource:
|
||||
https:
|
||||
;
|
||||
media-src
|
||||
'self'
|
||||
;
|
||||
frame-src
|
||||
'self'
|
||||
vscode-webview:
|
||||
;
|
||||
script-src
|
||||
'self'
|
||||
'unsafe-eval'
|
||||
blob:
|
||||
;
|
||||
style-src
|
||||
'self'
|
||||
'unsafe-inline'
|
||||
;
|
||||
connect-src
|
||||
'self'
|
||||
https:
|
||||
ws:
|
||||
;
|
||||
font-src
|
||||
'self'
|
||||
vscode-remote-resource:
|
||||
;
|
||||
require-trusted-types-for
|
||||
'script'
|
||||
;
|
||||
trusted-types
|
||||
amdLoader
|
||||
cellRendererEditorText
|
||||
defaultWorkerFactory
|
||||
diffEditorWidget
|
||||
diffReview
|
||||
domLineBreaksComputer
|
||||
dompurify
|
||||
editorGhostText
|
||||
editorViewLayer
|
||||
notebookRenderer
|
||||
stickyScrollViewLayer
|
||||
tokenizeToString
|
||||
;
|
||||
"/>
|
||||
</head>
|
||||
|
||||
<body aria-label="">
|
||||
|
|
Loading…
Reference in a new issue