zokki/softwareschmiede
zokki/softwareschmiede
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases5 Wiki Activity

fix: CSP allow inline scripts

Browse Source
This commit is contained in:
Tim-Niclas Oelschläger 2025-02-10 03:06:32 +01:00
parent 72c1594200
commit 57e2fcc4a6
Signed by: zokki
SSH Key Fingerprint: SHA256:HxmVKMFSukiF1LvbgazUKRFiTky2CzbvN72B8U1yhXo
2 changed files with 4 additions and 2 deletions

1
TODO.md
View File

@ -1,6 +1,7 @@
@TODO
- gitea rebuild website on each push -> script!!
- sha512 to scripts for csp
blog

5
src/layouts/Layout.astro
View File

@ -3,6 +3,7 @@ import { author } from '@/package.json';
import { CookieBanner, Footer, Header } from '@components/index';
import { getLangFromUrl, useTranslations } from '@i18n/utils';
import { fileTransferURL } from '@pages/en/file-transfer.astro';
import notificationScriptUrl from '@public/scripts/notification?url';
import { site, siteName } from '@shared/constants';
import { indexSuffixRegEx, type SchemaProps } from '@shared/helpers';
import noscriptStylesUrl from '@styles/noscript.scss?url';
@ -90,7 +91,7 @@ const mainProps = Object.keys(props).reduce((prev, curr) => {
import.meta.env.PROD && (
<meta
http-equiv="content-security-policy"
content={`default-src 'none'; script-src ${site}/_astro/ ${site}/scripts/; style-src ${site}/_astro/ 'unsafe-inline'; img-src ${site}/; font-src 'none'; connect-src ${site}/ ${fileTransferURL}; frame-src ${fileTransferURL}; object-src 'none'; media-src 'none'; worker-src 'none';`}
content={`default-src 'none'; script-src ${site}/_astro/ ${site}/scripts/ 'unsafe-inline'; script-src-attr 'none'; style-src ${site}/_astro/ 'unsafe-inline'; img-src ${site}/; font-src 'none'; connect-src ${site}/ ${fileTransferURL}; frame-src ${fileTransferURL}; object-src 'none'; media-src 'none'; worker-src 'none';`}
/>
)
}
@ -114,7 +115,7 @@ const mainProps = Object.keys(props).reduce((prev, curr) => {
<link rel="canonical" href={props.canonical || Astro.url.href.replace(indexSuffixRegEx, '')} />
<link rel="sitemap" href="/sitemap.xml" />
<script src="/scripts/notification.js" is:inline></script>
<script src={notificationScriptUrl} is:inline></script>
<ClientRouter />
</head>