Fixed CapsCSP bug allowing data: URLs to bypass font blocking (thanks…

… dcent and skriptimaahinen).
hackademix · Mar 1, 2020 · 8f2f845 · 8f2f845
1 parent acddfd8
commit 8f2f845
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/common/CapsCSP.js b/src/common/CapsCSP.js
@@ -2,7 +2,7 @@
 
 function CapsCSP(baseCSP = new CSP()) {
   return Object.assign(baseCSP, {
-    types: ["script", "object", "media"],
+    types: ["script", "object", "media", "font"],
     dataUriTypes: ["font", "media", "object"],
     buildFromCapabilities(capabilities, blockHttp = false) {
       let forbidData = new Set(this.dataUriTypes.filter(t => !capabilities.has(t)));