aboutsummaryrefslogtreecommitdiff
path: root/dev
diff options
context:
space:
mode:
authortoasted-nutbread <toasted-nutbread@users.noreply.github.com>2020-12-13 13:56:45 -0500
committerGitHub <noreply@github.com>2020-12-13 13:56:45 -0500
commit05e213674c794d55a05acc61cb24ed9642ccc1db (patch)
treecf245004fb2f47da6d2720bd470880b3c9eed713 /dev
parentdabe5fa8994de1f93acd41a29bd168f485a98e29 (diff)
Update content-security-policy to be more explicit (#1109)
Diffstat (limited to 'dev')
-rw-r--r--dev/data/manifest-variants.json6
1 files changed, 3 insertions, 3 deletions
diff --git a/dev/data/manifest-variants.json b/dev/data/manifest-variants.json
index 486e78c0..3f65d86f 100644
--- a/dev/data/manifest-variants.json
+++ b/dev/data/manifest-variants.json
@@ -71,7 +71,7 @@
"pages": [
"bg/template-renderer.html"
],
- "content_security_policy": "sandbox allow-scripts; script-src 'self' 'unsafe-eval'; object-src 'self'"
+ "content_security_policy": "sandbox allow-scripts; default-src 'self'; script-src 'self' 'unsafe-eval'"
},
"permissions": [
"<all_urls>",
@@ -103,7 +103,7 @@
"fg/float.html",
"bg/template-renderer.html"
],
- "content_security_policy": "script-src 'self'; object-src 'self'"
+ "content_security_policy": "default-src 'self'; style-src 'self' 'unsafe-inline'; media-src *; connect-src *"
},
"variants": [
{
@@ -146,7 +146,7 @@
{
"action": "set",
"path": ["content_security_policy"],
- "value": "script-src 'self' 'unsafe-eval'; object-src 'self'"
+ "value": "default-src 'self'; script-src 'self' 'unsafe-eval'; style-src 'self' 'unsafe-inline'; media-src *; connect-src *"
},
{
"action": "set",