Unfloyded/Legamunt
0
0
Fork 0
Code Activity

Change form-action Content-Security-Policy directive to be more restrictive (#26897)

Browse source
This commit is contained in:
Claire 2024-09-12 15:24:19 +02:00 • committed by GitHub
parent 5f782f9629
commit a496aeabcb
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
4 changed files with 29 additions and 21 deletions
Download patch file Download diff file Expand all files Collapse all files

2
spec/requests/content_security_policy_spec.rb
View file

@ -26,7 +26,7 @@ RSpec.describe 'Content-Security-Policy' do
connect-src 'self' data: blob: https://cb6e6126.ngrok.io #{Rails.configuration.x.streaming_api_base_url}
default-src 'none'
font-src 'self' https://cb6e6126.ngrok.io
form-action 'self'
form-action 'none'
frame-ancestors 'none'
frame-src 'self' https:
img-src 'self' data: blob: https://cb6e6126.ngrok.io