From f9b3304b8231c6ec0ad8d49028991dfa471e2f19 Mon Sep 17 00:00:00 2001 From: Arya Kiran Date: Tue, 9 May 2023 16:49:00 +0530 Subject: [PATCH] add CSP for non-proxying --- serve/serve.go | 2 ++ 1 file changed, 2 insertions(+) diff --git a/serve/serve.go b/serve/serve.go index 94123a8..e25b4d6 100644 --- a/serve/serve.go +++ b/serve/serve.go @@ -96,6 +96,8 @@ func Serve(port string) { c.Set("Referrer-Policy", "no-referrer") if proxying == "true" { c.Set("Content-Security-Policy", "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data; font-src 'self'; script-src 'self'; frame-ancestors 'self'; form-action 'self'; base-uri 'self'; connect-src 'self';") + } else { + c.Set("Content-Security-Policy", "default-src 'self' https://camo.githubusercontent.com https://avatars.githubusercontent.com https://github.com https://raw.githubusercontent.com https://gist.github.com; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data https://camo.githubusercontent.com https://avatars.githubusercontent.com https://gist.github.com; font-src 'self'; connect-src 'self' https://camo.githubusercontent.com https://avatars.githubusercontent.com https://github.com https://raw.githubusercontent.com https://gist.github.com; frame-ancestors 'self'; form-action 'self'; base-uri 'self'") } c.Set("Strict-Transport-Security", "max-age=31536000; includeSubDomains; preload")