fork/cellxgene
1
0
Fork 0
mirror of https://github.com/chanzuckerberg/cellxgene.git synced 2026-10-07 13:58:11 +08:00
Code Issues Packages Projects Releases Wiki Activity

add CSP sources for obsolete browser prompt (#1731)

Browse Source 
Adds script hash and explicit domain to `img-src` directive
This commit is contained in:
Severiano Badajoz
2020-08-11 16:50:46 -07:00
committed by GitHub
parent 80f6137528
commit f221856ae1
2 changed files with 7 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
client/configuration/webpack/obsoleteHTMLTemplate.html
+1
View File
@@ -1,4 +1,5 @@
<script> <script>
/** Reflect ANY changes to this script in the script hash in `server/eb/app.py` **/
var root = document.getElementById("root"); var root = document.getElementById("root");
root.remove(); root.remove();
var portals = document.getElementsByClassName("bp3-portal"); var portals = document.getElementsByClassName("bp3-portal");
server/eb/app.py
+6 -2
View File
@@ -96,12 +96,16 @@ class WSGIServer(Server):
def _before_adding_routes(app, app_config): def _before_adding_routes(app, app_config):
script_hashes = WSGIServer.get_csp_hashes(app, app_config) script_hashes = WSGIServer.get_csp_hashes(app, app_config)
server_config = app_config.server_config server_config = app_config.server_config
# This hash should be in sync with the script within
# `client/configuration/webpack/obsoleteHTMLTemplate.html`
obsolete_browser_script_hash = ['SHA25-0028D52E332C015C3ED9929926F4000BB4020B8CB85C1F5769D6AA3BA711F58E']
csp = { csp = {
"default-src": ["'self'"], "default-src": ["'self'"],
"connect-src": ["'self'"], "connect-src": ["'self'"],
"script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"] + script_hashes, "script-src": ["'self'", "'unsafe-eval'", "'unsafe-inline'"]
+ obsolete_browser_script_hash + script_hashes,
"style-src": ["'self'", "'unsafe-inline'"], "style-src": ["'self'", "'unsafe-inline'"],
"img-src": ["'self'", "data:"], "img-src": ["'self'", "'https://cellxgene.cziscience.com'", "data:"],
"object-src": ["'none'"], "object-src": ["'none'"],
"base-uri": ["'none'"], "base-uri": ["'none'"],
"frame-ancestors": ["'none'"], "frame-ancestors": ["'none'"],