Merge pull request #171 from mineralsfree/SEC-1051

SEC-1051: added disqus.com frame-src to csp
cfengine · Jul 4, 2024 · 5ee12fb · 5ee12fb
2 parents e76398f + dff364b
commit 5ee12fb
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/nginx.conf b/nginx.conf
@@ -74,7 +74,7 @@ http {
         add_header X-Content-Type-Options "nosniff" always;
         add_header 'Referrer-Policy' 'strict-origin';
         # 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' hugo discuss template (https://github.com/gohugoio/hugo/blob/master/tpl/tplimpl/embedded/templates/disqus.html)
-        add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net; connect-src 'self' *.disqus.com *.disquscdn.com *.google-analytics.com; script-src 'self' 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' *.disqus.com *.disquscdn.com *.googletagmanager.com; object-src 'self'; img-src 'self' data: https:; font-src 'self' https:; frame-src 'self' www.google.com www.youtube.com *.disqus.com;  manifest-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests;";
+        add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net; connect-src 'self' *.disqus.com *.disquscdn.com *.google-analytics.com; script-src 'self' 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' *.disqus.com *.disquscdn.com *.googletagmanager.com; object-src 'self'; img-src 'self' data: https:; font-src 'self' https:; frame-src 'self' www.google.com www.youtube.com *.disqus.com disqus.com;  manifest-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests;";
 
         #add_header Feature-Policy "speaker self;fullscreen self;";
         ## Block common exploits

diff --git a/static/js/modules-list.js b/static/js/modules-list.js
@@ -120,7 +120,7 @@ document.addEventListener('TAGS_LOADED', function (e) {
         appliedTagsElement.style.display = 'block';
         searchParts.tags.push(...selectedTags);
         document.dispatchEvent(new Event('RENDER'))
-        document.querySelector('.modules-applied-tags ul').append(...selectedTags.map(item => createTagElement(sanitizeString(item, true))));
+        document.querySelector('.modules-applied-tags ul').append(...selectedTags.map(item => createTagElement(sanitizeString(item), true)));
     } else if (appliedTagsElement) {
         appliedTagsElement.style.display = 'none';
     }