fix: Fix CSP for monaco editor (coder#5358)

BrunoQuaresma · web-flow · commit 3c9dab34bfa8 · 2022-12-08T18:32:41.000Z
diff --git a/site/site.go b/site/site.go
@@ -266,9 +266,12 @@ func cspHeaders(next http.Handler) http.Handler {
 			CSPDirectiveDefaultSrc: {"'self'"},
 			CSPDirectiveConnectSrc: {"'self'"},
 			CSPDirectiveChildSrc:   {"'self'"},
-			CSPDirectiveScriptSrc:  {"'self'"},
-			CSPDirectiveFontSrc:    {"'self'"},
-			CSPDirectiveStyleSrc:   {"'self' 'unsafe-inline'"},
+			// https://cdn.jsdelivr.net is used by monaco editor on FE for Syntax Highlight
+			// https://github.com/suren-atoyan/monaco-react/issues/168
+			CSPDirectiveScriptSrc: {"'self' https://cdn.jsdelivr.net"},
+			// data: is used by monaco editor on FE for Syntax Highlight
+			CSPDirectiveFontSrc:  {"'self' data:"},
+			CSPDirectiveStyleSrc: {"'self' 'unsafe-inline'"},
 			// object-src is needed to support code-server
 			CSPDirectiveObjectSrc: {"'self'"},
 			// blob: for loading the pwa manifest for code-server
