ulivargas/classroomio
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: cross site scripting with html content

Browse Source
This commit is contained in:
Rotimi Best
2025-12-03 09:33:53 +01:00
parent f2b719cd1b
commit 7b18c325da
15 changed files with 458 additions and 151 deletions
Download Patch File Download Diff File Expand all files Collapse all files
apps/dashboard/svelte.config.js
+72
View File
@@ -18,6 +18,78 @@ const config = {
alias: {
$lib: path.resolve('./src/lib'),
$mail: path.resolve('./src/mail')
},
csp: {
directives: {
'default-src': ['self'],
'script-src': ['self', 'https://assets.cdn.clsrio.com', 'https://cdnjs.cloudflare.com'],
'style-src': [
'self',
'unsafe-inline',
'https://cdn.plyr.io',
'https://unpkg.com/[email protected]/dist/katex.min.css',
'https://assets.cdn.clsrio.com/eqneditor_1.css'
],
'style-src-elem': [
'self',
'unsafe-inline',
'https://cdn.plyr.io',
'https://unpkg.com/[email protected]/dist/katex.min.css',
'https://assets.cdn.clsrio.com/eqneditor_1.css'
],
'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
'img-src': ['self', 'data:', 'https:'],
'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
'connect-src': [
'self',
'https://*.supabase.co',
'https://assets.cdn.clsrio.com',
'https://cdn.plyr.io',
'http://localhost:54321',
'ws://localhost:54321',
'wss://*.supabase.co'
],
'object-src': ['none'],
'base-uri': ['self'],
'form-action': ['self'],
'frame-ancestors': ['none'],
'upgrade-insecure-requests': true
},
reportOnly: {
'default-src': ['self'],
'script-src': ['self', 'https://assets.cdn.clsrio.com', 'https://cdnjs.cloudflare.com'],
'style-src': [
'self',
'unsafe-inline',
'https://cdn.plyr.io',
'https://unpkg.com/[email protected]/dist/katex.min.css',
'https://assets.cdn.clsrio.com/eqneditor_1.css'
],
'style-src-elem': [
'self',
'unsafe-inline',
'https://cdn.plyr.io',
'https://unpkg.com/[email protected]/dist/katex.min.css',
'https://assets.cdn.clsrio.com/eqneditor_1.css'
],
'font-src': ['self', 'https://fonts.gstatic.com', 'https://cdn.plyr.io'],
'img-src': ['self', 'data:', 'https:'],
'frame-src': ['self', 'https://www.youtube.com', 'https://youtube.com'],
'connect-src': [
'self',
'https://*.supabase.co',
'https://assets.cdn.clsrio.com',
'https://cdn.plyr.io',
'http://localhost:54321',
'ws://localhost:54321',
'wss://*.supabase.co'
],
'object-src': ['none'],
'base-uri': ['self'],
'form-action': ['self'],
'frame-ancestors': ['none'],
'report-uri': ['/csp-report']
}
}
}
};