Allow all images in CSP for now since we hotlink

billoneil · billoneil · commit 33e78546c13e · 2018-01-13T14:06:08.000-05:00
diff --git a/stubbornjava-webapp/src/main/java/com/stubbornjava/webapp/StubbornJavaWebApp.java b/stubbornjava-webapp/src/main/java/com/stubbornjava/webapp/StubbornJavaWebApp.java
@@ -36,9 +36,11 @@ private static HttpHandler exceptionHandler(HttpHandler next) {
     private static HttpHandler contentSecurityPolicy(HttpHandler delegate) {
         return new ContentSecurityPolicyHandler.Builder()
                 .defaultSrc(ContentSecurityPolicy.SELF)
-                .scriptSrc("'self'", "https://www.google-analytics.com")
-                .imgSrc("'self'", "https://www.google-analytics.com")
-                .connectSrc("'self'", "https://www.google-analytics.com")
+                .scriptSrc(ContentSecurityPolicy.SELF.getValue(), "https://www.google-analytics.com")
+                // Drop the wildcard when we host our own images.
+                .imgSrc(ContentSecurityPolicy.SELF.getValue(), "https://www.google-analytics.com", "*")
+                .connectSrc(ContentSecurityPolicy.SELF.getValue(), "https://www.google-analytics.com")
+                .fontSrc(ContentSecurityPolicy.SELF.getValue(), "data:")
                 .styleSrc(ContentSecurityPolicy.SELF.getValue(), ContentSecurityPolicy.UNSAFE_INLINE.getValue())
                 .build(delegate);
     }
