@@ -119,22 +119,23 @@ protected void configure(HttpSecurity http) throws Exception {
119
119
.defaultsDisabled () // TODO
120
120
.contentSecurityPolicy (
121
121
// default policy prevents loading resources from any source
122
- "default-src 'none'; " +
122
+ "default-src 'none'; "
123
123
// 'self' is required for: our own CSS files
124
124
// 'https://cdn.rawgit.com' is required for: languages.min.css (TODO: GH #246)
125
- "style-src 'self' https://cdn.rawgit.com; " +
125
+ + "style-src 'self' https://cdn.rawgit.com; "
126
126
// 'self' is required for: our own JS files
127
- // 'unsafe-inline' is required for: jquery.min.js (that is using code inside of event handlers.
128
- // We can't use hashing algorithms because they aren't supported for handlers. In future,
129
- // we should get rid of jQuery or use 'unsafe-hashed-attributes' from CSP3. Details:
130
- // https://github.com/jquery/jquery/blob/d71f6a53927ad02d728503385d15539b73d21ac8/jquery.js#L1441-L1447
127
+ // 'unsafe-inline' is required for: jquery.min.js (that is using code inside of
128
+ // event handlers. We can't use hashing algorithms because they aren't supported
129
+ // for handlers. In future, we should get rid of jQuery or use
130
+ // 'unsafe-hashed-attributes' from CSP3. Details:
131
+ // https://github.com/jquery/jquery/blob/d71f6a53927ad02d/jquery.js#L1441-L1447
131
132
// and https://w3c.github.io/webappsec-csp/#unsafe-hashed-attributes-usage)
132
- "script-src 'self' 'unsafe-inline'; " +
133
+ + "script-src 'self' 'unsafe-inline'; "
133
134
// 'https://cdn.rawgit.com' is required for: languages.png (TODO: GH #246)
134
- // 'https://raw.githubusercontent.com' is required for: languages.png (TODO: GH #246)
135
- "img-src https://cdn.rawgit.com https://raw.githubusercontent.com; " +
135
+ // 'https://raw.githubusercontent.com' is required for: languages.png
136
+ + "img-src https://cdn.rawgit.com https://raw.githubusercontent.com; "
136
137
// 'self' is required for: glyphicons-halflings-regular.woff2 from bootstrap
137
- "font-src 'self'"
138
+ + "font-src 'self'"
138
139
).reportOnly ();
139
140
}
140
141
0 commit comments