daohualiuxiang
/
vscode
mirror of https://github.com/microsoft/vscode.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Don't use 'self' for image editor csp 

On desktop, we now serve webview resources from a different origin than the webview itself. This means we no longer can use `'self'` in our CSP as shorthand and instead should always use the provided `cspSource`
pull/120916/head
Matt Bierner 2021-04-08 17:08:08 -07:00
parent 044a99585c
commit 9c9e188aa0
No known key found for this signature in database
GPG Key ID: 099C331567E11888
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
extensions/image-preview/src/preview.ts
View File

@ -212,6 +212,7 @@ class Preview extends Disposable {
const nonce = Date.now().toString();
const cspSource = this.webviewEditor.webview.cspSource;
return /* html */`<!DOCTYPE html>
<html lang="en">
<head>
@ -225,7 +226,7 @@ class Preview extends Disposable {
<link rel="stylesheet" href="${escapeAttribute(this.extensionResource('/media/main.css'))}" type="text/css" media="screen" nonce="${nonce}">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src 'self' data: ${this.webviewEditor.webview.cspSource}; script-src 'nonce-${nonce}'; style-src 'self' 'nonce-${nonce}';">
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src data: ${cspSource}; script-src 'nonce-${nonce}'; style-src ${cspSource} 'nonce-${nonce}';">
<meta id="image-preview-settings" data-settings="${escapeAttribute(JSON.stringify(settings))}">
</head>
<body class="container image scale-to-fit loading">