CSP header adjustments (backport #3068) #3075
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![mergify[bot]](https://avatars.githubusercontent.com/in/10562?s=60&v=4){kind=small}
|
@Mergifyio rebase |
Remove frame-acestors completely because it isn't included into an iframe anymore. If this is still required the CSP settings can be adjusted via a command line parameter. More important don't allow executing javascript from inline html. Only from references javascript files. But allow to load CSS from inline <style> elements via style-src-elem (not supported by firefox yet) and style-src CSP settings. Fixes AP-1507 (cherry picked from commit 9c6bd5b)
(cherry picked from commit 279466b)
Froma https://create-react-app.dev/docs/advanced-configuration > By default, Create React App will embed the runtime script into > index.html during the production build. When set to false, the script > will not be embedded and will be imported as usual. This is normally > required when dealing with CSP. (cherry picked from commit 44c7121)
(cherry picked from commit a6a9cea)
swaterkamp
force-pushed
the
mergify/bp/master/pr-3068
branch
from
9c8b0c7 to
b08565f
Compare
|
Command
|
Codecov Report
@@ Coverage Diff @@
## master #3075 +/- ##
===========================================
+ Coverage 36.73% 56.42% +19.69%
===========================================
Files 991 1036 +45
Lines 22191 25168 +2977
Branches 6110 7197 +1087
===========================================
+ Hits 8151 14202 +6051
+ Misses 12715 9910 -2805
+ Partials 1325 1056 -269
Continue to review full report at Codecov.
|
bjoernricks
approved these changes
Jul 21, 2021
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is an automatic backport of pull request #3068 done by Mergify.
AP-1507
Mergify commands and options
More conditions and actions can be found in the documentation.
You can also trigger Mergify actions by commenting on this pull request:
@Mergifyio refreshwill re-evaluate the rules@Mergifyio rebasewill rebase this PR on its base branch@Mergifyio updatewill merge the base branch into this PR@Mergifyio backport <destination>will backport this PR on<destination>branchAdditionally, on Mergify dashboard you can:
Finally, you can contact us on https://mergify.io/