From 0ebfba8d050e968a404a16e94a9930c72fa830d9 Mon Sep 17 00:00:00 2001 From: Ozzie Isaacs Date: Sun, 25 Feb 2024 19:32:04 +0100 Subject: [PATCH] Added blobs to csp for reader page (fix for #3005) --- cps/web.py | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/cps/web.py b/cps/web.py index 68b9bbc5..8d8faed2 100644 --- a/cps/web.py +++ b/cps/web.py @@ -86,9 +86,13 @@ except ImportError: @app.after_request def add_security_headers(resp): - csp = "default-src 'self'" - csp += ''.join([' ' + host for host in config.config_trustedhosts.strip().split(',')]) - csp += " 'unsafe-inline' 'unsafe-eval'; font-src 'self' data:; img-src 'self'" + default_src = ([host.strip() for host in config.config_trustedhosts.split(',') if host] + + ["'self'", "'unsafe-inline'", "'unsafe-eval'"]) + csp = "default-src " + ' '.join(default_src) + "; " + csp += "font-src 'self' data:" + if request.endpoint == "web.read_book": + csp += " blob:" + csp += "; img-src 'self'" if request.path.startswith("/author/") and config.config_use_goodreads: csp += " images.gr-assets.com i.gr-assets.com s.gr-assets.com" csp += " data:"