NunoSempere/calibre-web
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

CSP invalid syntax

Browse Source 
CSP had some "cosmetic" errors

Before : default-src 'self'  'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self' data: style-src-elem 'self' blob: 'unsafe-inline';object-src: 'none';
After :    default-src 'self'  'unsafe-inline' 'unsafe-eval'; font-src 'self' data:;  img-src 'self' data:; style-src-elem 'self' blob: 'unsafe-inline'; object-src 'none';
This commit is contained in:
Petipopotam 2023-01-24 10:51:48 +01:00 committed by GitHub
parent 36cb454d1c
commit 1ad8dc102a
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
cps/web.py
View File

@ -85,14 +85,14 @@ def add_security_headers(resp):
csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self'" csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self'"
if request.path.startswith("/author/") and config.config_use_goodreads: if request.path.startswith("/author/") and config.config_use_goodreads:
csp += " images.gr-assets.com i.gr-assets.com s.gr-assets.com" csp += " images.gr-assets.com i.gr-assets.com s.gr-assets.com"
csp += " data:" csp += " data:;"
if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive: if request.endpoint == "edit-book.show_edit_book" or config.config_use_google_drive:
csp += " *;" csp += " *;"
elif request.endpoint == "web.read_book": elif request.endpoint == "web.read_book":
csp += " style-src-elem 'self' blob: 'unsafe-inline';" csp += " style-src-elem 'self' blob: 'unsafe-inline';"
else: else:
csp += ";" csp += ";"
csp += "object-src: 'none';" csp += " object-src 'none';"
resp.headers['Content-Security-Policy'] = csp resp.headers['Content-Security-Policy'] = csp
resp.headers['X-Content-Type-Options'] = 'nosniff' resp.headers['X-Content-Type-Options'] = 'nosniff'
resp.headers['X-Frame-Options'] = 'SAMEORIGIN' resp.headers['X-Frame-Options'] = 'SAMEORIGIN'