From dff364b33f92dade081909ef6a67fb0dc6da9768 Mon Sep 17 00:00:00 2001 From: Mikita Pilinka Date: Wed, 3 Jul 2024 10:45:24 +0200 Subject: [PATCH] added disqus.com frame-src to csp Ticket: SEC-1051 Changelog: None Signed-off-by: Mikita Pilinka --- nginx.conf | 2 +- static/js/modules-list.js | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/nginx.conf b/nginx.conf index dd607c9..ce5ab5c 100644 --- a/nginx.conf +++ b/nginx.conf @@ -74,7 +74,7 @@ http { add_header X-Content-Type-Options "nosniff" always; add_header 'Referrer-Policy' 'strict-origin'; # 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' hugo discuss template (https://github.com/gohugoio/hugo/blob/master/tpl/tplimpl/embedded/templates/disqus.html) - add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net; connect-src 'self' *.disqus.com *.disquscdn.com *.google-analytics.com; script-src 'self' 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' *.disqus.com *.disquscdn.com *.googletagmanager.com; object-src 'self'; img-src 'self' data: https:; font-src 'self' https:; frame-src 'self' www.google.com www.youtube.com *.disqus.com; manifest-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests;"; + add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline' cdn.jsdelivr.net; connect-src 'self' *.disqus.com *.disquscdn.com *.google-analytics.com; script-src 'self' 'sha256-ruKmkK0iwJgE/F4xuzLY3V2OuzVOOJISav7NURhCKsM=' *.disqus.com *.disquscdn.com *.googletagmanager.com; object-src 'self'; img-src 'self' data: https:; font-src 'self' https:; frame-src 'self' www.google.com www.youtube.com *.disqus.com disqus.com; manifest-src 'self'; base-uri 'self'; form-action 'self'; frame-ancestors 'self'; upgrade-insecure-requests;"; #add_header Feature-Policy "speaker self;fullscreen self;"; ## Block common exploits diff --git a/static/js/modules-list.js b/static/js/modules-list.js index 1de3616..cf505b8 100644 --- a/static/js/modules-list.js +++ b/static/js/modules-list.js @@ -120,7 +120,7 @@ document.addEventListener('TAGS_LOADED', function (e) { appliedTagsElement.style.display = 'block'; searchParts.tags.push(...selectedTags); document.dispatchEvent(new Event('RENDER')) - document.querySelector('.modules-applied-tags ul').append(...selectedTags.map(item => createTagElement(sanitizeString(item, true)))); + document.querySelector('.modules-applied-tags ul').append(...selectedTags.map(item => createTagElement(sanitizeString(item), true))); } else if (appliedTagsElement) { appliedTagsElement.style.display = 'none'; }