Mar 21, 2023 · Mar 21, 2023 · Mar 21, 2023 · Mar 21, 2023 · Mar 21, 2023 · Mar 21, 2023
diff --git a/site/site.go b/site/site.go
 CSPDirectiveScriptSrc: {"'self' https://cdn.jsdelivr.net"},
 CSPDirectiveStyleSrc:  {"'self' 'unsafe-inline' https://cdn.jsdelivr.net"},
 // data: is used by monaco editor on FE for Syntax Highlight
 CSPDirectiveFontSrc: {"'self' data:"},
 CSPDirectiveFontSrc:   {"'self' https://cdn.jsdelivr.net data:"},
 CSPDirectiveWorkerSrc: {"'self' blob:"},
 // object-src is needed to support code-server
 CSPDirectiveObjectSrc: {"'self'"},
 // blob: for loading the pwa manifest for code-server
Original file line number	Diff line number	Diff line change
Expand Up		@@ -326,7 +326,8 @@ func cspHeaders(next http.Handler) http.Handler {
		CSPDirectiveScriptSrc: {"'self' https://cdn.jsdelivr.net"},
		CSPDirectiveStyleSrc: {"'self' 'unsafe-inline' https://cdn.jsdelivr.net"},
		// data: is used by monaco editor on FE for Syntax Highlight
		CSPDirectiveFontSrc: {"'self' data:"},
		CSPDirectiveFontSrc: {"'self' https://cdn.jsdelivr.net data:"},
Copy link Member kylecarbsMar 21, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. cc@Emyrk @BrunoQuaresma we can't import external assets like this, because we're self-hosted customers might be airgapped. Copy link CollaboratorAuthor BrunoQuaresmaMar 21, 2023• edited Loading Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Yes, I'm aware of it. Since we are already doing it I added it as a quick fix. In the past, I tried to make Monaco editor work with local file but it didn't work. I will give it a try again during the week. If we are not able to get this working, we may need a plan. Copy link Member kylecarbsMar 21, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Ahh, I see! That's helpful context. Customers will likely see this come up in security scans, becauseI believe users can host anything on`jsdelivr`, so an XSS attack becomes possible with this in product. Copy link Member EmyrkMar 21, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. Good to know about jsdeliver. We can match specific files, eg: `https://cdn.jsdelivr.net/the/file/we/want` Copy link CollaboratorAuthor BrunoQuaresmaMar 21, 2023 Choose a reason for hiding this comment The reason will be displayed to describe this comment to others.Learn more. I totally agree. I think would be very hard to track files individually.
		CSPDirectiveWorkerSrc: {"'self' blob:"},
		// object-src is needed to support code-server
		CSPDirectiveObjectSrc: {"'self'"},
		// blob: for loading the pwa manifest for code-server
Expand Down