fix(site): Fix CSP directives for monaco #6709
Conversation
| @@ -326,7 +326,8 @@ func cspHeaders(next http.Handler) http.Handler { | |||
| CSPDirectiveScriptSrc: {"'self' https://cdn.jsdelivr.net"}, | |||
| CSPDirectiveStyleSrc: {"'self' 'unsafe-inline' https://cdn.jsdelivr.net"}, | |||
| // data: is used by monaco editor on FE for Syntax Highlight | |||
| CSPDirectiveFontSrc: {"'self' data:"}, | |||
| CSPDirectiveFontSrc: {"'self' https://cdn.jsdelivr.net data:"}, | |||
There was a problem hiding this comment.
cc @Emyrk
@BrunoQuaresma we can't import external assets like this, because we're self-hosted customers might be airgapped.
There was a problem hiding this comment.
Yes, I'm aware of it. Since we are already doing it I added it as a quick fix. In the past, I tried to make Monaco editor work with local file but it didn't work. I will give it a try again during the week. If we are not able to get this working, we may need a plan.
There was a problem hiding this comment.
Ahh, I see! That's helpful context.
Customers will likely see this come up in security scans, because I believe users can host anything on jsdelivr, so an XSS attack becomes possible with this in product.
There was a problem hiding this comment.
Good to know about jsdeliver. We can match specific files, eg:
https://cdn.jsdelivr.net/the/file/we/want
There was a problem hiding this comment.
I totally agree. I think would be very hard to track files individually.
Closes #6590