development/vscode
development/vscode
1
0
Fork 0
mirror of https://github.com/Microsoft/vscode synced 2024-08-27 13:00:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

csp - tighten rules and update trusted types (#178675)

Browse source 
* csp - tighten rules and update trusted types

* bring back `https:` for `img-src`

* also update others
This commit is contained in:
Benjamin Pasero 2023-03-31 12:17:41 +02:00 committed by GitHub
parent f82fef56ec
commit 4a21266bdd
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
6 changed files with 212 additions and 8 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

26
src/vs/code/electron-sandbox/issue/issueReporter-dev.html
View file

@ -3,7 +3,31 @@
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
<meta
http-equiv="Content-Security-Policy"
content="
default-src
'none'
;
img-src
'self'
data:
;
script-src
'self'
;
style-src
'self'
'unsafe-inline'
;
connect-src
'self'
https:
;
font-src
'self'
;
">
<style>
body {
display: none

26
src/vs/code/electron-sandbox/issue/issueReporter.html
View file

@ -3,7 +3,31 @@
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
<meta
http-equiv="Content-Security-Policy"
content="
default-src
'none'
;
img-src
'self'
data:
;
script-src
'self'
;
style-src
'self'
'unsafe-inline'
;
connect-src
'self'
https:
;
font-src
'self'
;
">
<style>
body {
display: none

26
src/vs/code/electron-sandbox/processExplorer/processExplorer-dev.html
View file

@ -3,7 +3,31 @@
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
<meta
http-equiv="Content-Security-Policy"
content="
default-src
'none'
;
img-src
'self'
data:
;
script-src
'self'
;
style-src
'self'
'unsafe-inline'
;
connect-src
'self'
https:
;
font-src
'self'
;
">
</head>
<body aria-label="">

26
src/vs/code/electron-sandbox/processExplorer/processExplorer.html
View file

@ -3,7 +3,31 @@
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data:; media-src 'none'; child-src 'self'; object-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; connect-src 'self' https:; font-src 'self' https:;">
<meta
http-equiv="Content-Security-Policy"
content="
default-src
'none'
;
img-src
'self'
data:
;
script-src
'self'
;
style-src
'self'
'unsafe-inline'
;
connect-src
'self'
https:
;
font-src
'self'
;
">
</head>
<body aria-label="">

58
src/vs/code/electron-sandbox/workbench/workbench-dev.html
View file

@ -3,8 +3,62 @@
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data: blob: vscode-remote-resource:; media-src 'self'; frame-src 'self' vscode-webview:; object-src 'self'; script-src 'self' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ws:; font-src 'self' https: vscode-remote-resource:;">
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; trusted-types amdLoader cellRendererEditorText defaultWorkerFactory diffEditorWidget stickyScrollViewLayer editorGhostText domLineBreaksComputer editorViewLayer diffReview dompurify notebookRenderer safeInnerHtml standaloneColorizer tokenizeToString;">
<meta
http-equiv="Content-Security-Policy"
content="
default-src
'none'
;
img-src
'self'
data:
blob:
vscode-remote-resource:
https:
;
media-src
'self'
;
frame-src
'self'
vscode-webview:
;
script-src
'self'
'unsafe-eval'
blob:
;
style-src
'self'
'unsafe-inline'
;
connect-src
'self'
https:
ws:
;
font-src
'self'
vscode-remote-resource:
;
require-trusted-types-for
'script'
;
trusted-types
amdLoader
cellRendererEditorText
defaultWorkerFactory
diffEditorWidget
diffReview
domLineBreaksComputer
dompurify
editorGhostText
editorViewLayer
notebookRenderer
stickyScrollViewLayer
tokenizeToString
;
"/>
</head>
<body aria-label="">

58
src/vs/code/electron-sandbox/workbench/workbench.html
View file

@ -3,8 +3,62 @@
<html>
<head>
<meta charset="utf-8" />
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' https: data: blob: vscode-remote-resource:; media-src 'self'; frame-src 'self' vscode-webview:; object-src 'self'; script-src 'self' 'unsafe-eval' blob:; style-src 'self' 'unsafe-inline'; connect-src 'self' https: ws:; font-src 'self' https: vscode-remote-resource:;">
<meta http-equiv="Content-Security-Policy" content="require-trusted-types-for 'script'; trusted-types amdLoader cellRendererEditorText defaultWorkerFactory diffEditorWidget stickyScrollViewLayer editorGhostText domLineBreaksComputer editorViewLayer diffReview dompurify notebookRenderer safeInnerHtml standaloneColorizer tokenizeToString;">
<meta
http-equiv="Content-Security-Policy"
content="
default-src
'none'
;
img-src
'self'
data:
blob:
vscode-remote-resource:
https:
;
media-src
'self'
;
frame-src
'self'
vscode-webview:
;
script-src
'self'
'unsafe-eval'
blob:
;
style-src
'self'
'unsafe-inline'
;
connect-src
'self'
https:
ws:
;
font-src
'self'
vscode-remote-resource:
;
require-trusted-types-for
'script'
;
trusted-types
amdLoader
cellRendererEditorText
defaultWorkerFactory
diffEditorWidget
diffReview
domLineBreaksComputer
dompurify
editorGhostText
editorViewLayer
notebookRenderer
stickyScrollViewLayer
tokenizeToString
;
"/>
</head>
<body aria-label="">