Skip to content

Commit 5fa7554

Browse files
committed
SecurityConfig: fix errors from CheckStyle.
Correction for 4d0922e commit. Addressed to #226
1 parent 4d0922e commit 5fa7554

File tree

1 file changed

+11
-10
lines changed

1 file changed

+11
-10
lines changed

src/main/java/ru/mystamps/web/support/spring/security/SecurityConfig.java

Lines changed: 11 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -119,22 +119,23 @@ protected void configure(HttpSecurity http) throws Exception {
119119
.defaultsDisabled() // TODO
120120
.contentSecurityPolicy(
121121
// default policy prevents loading resources from any source
122-
"default-src 'none'; " +
122+
"default-src 'none'; "
123123
// 'self' is required for: our own CSS files
124124
// 'https://cdn.rawgit.com' is required for: languages.min.css (TODO: GH #246)
125-
"style-src 'self' https://cdn.rawgit.com; " +
125+
+ "style-src 'self' https://cdn.rawgit.com; "
126126
// 'self' is required for: our own JS files
127-
// 'unsafe-inline' is required for: jquery.min.js (that is using code inside of event handlers.
128-
// We can't use hashing algorithms because they aren't supported for handlers. In future,
129-
// we should get rid of jQuery or use 'unsafe-hashed-attributes' from CSP3. Details:
130-
// https://github.com/jquery/jquery/blob/d71f6a53927ad02d728503385d15539b73d21ac8/jquery.js#L1441-L1447
127+
// 'unsafe-inline' is required for: jquery.min.js (that is using code inside of
128+
// event handlers. We can't use hashing algorithms because they aren't supported
129+
// for handlers. In future, we should get rid of jQuery or use
130+
// 'unsafe-hashed-attributes' from CSP3. Details:
131+
// https://github.com/jquery/jquery/blob/d71f6a53927ad02d/jquery.js#L1441-L1447
131132
// and https://w3c.github.io/webappsec-csp/#unsafe-hashed-attributes-usage)
132-
"script-src 'self' 'unsafe-inline'; " +
133+
+ "script-src 'self' 'unsafe-inline'; "
133134
// 'https://cdn.rawgit.com' is required for: languages.png (TODO: GH #246)
134-
// 'https://raw.githubusercontent.com' is required for: languages.png (TODO: GH #246)
135-
"img-src https://cdn.rawgit.com https://raw.githubusercontent.com; " +
135+
// 'https://raw.githubusercontent.com' is required for: languages.png
136+
+ "img-src https://cdn.rawgit.com https://raw.githubusercontent.com; "
136137
// 'self' is required for: glyphicons-halflings-regular.woff2 from bootstrap
137-
"font-src 'self'"
138+
+ "font-src 'self'"
138139
).reportOnly();
139140
}
140141

0 commit comments

Comments
 (0)