Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

bugfix(#2152): Docs not support "http" markdown image #2171

Merged
merged 3 commits into from
May 22, 2024
Merged

bugfix(#2152): Docs not support "http" markdown image #2171

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
32945f4
bugfix(#2152): Docs not support "http" markdown image
Apr 25, 2024
7cbf1c9
fix: added documentation (#2152)
Apr 26, 2024
8e55ca3
Merge branch 'usebruno:main' into feature/2152-docs-not-support-http-…
end3rbyte May 9, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion packages/bruno-electron/src/index.js
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ const contentSecurityPolicy = [
"font-src 'self' https:",
// this has been commented out to make oauth2 work
// "form-action 'none'",
"img-src 'self' blob: data: https:",
"img-src 'self' blob: data: http: https:",
end3rbyte marked this conversation as resolved.
Show resolved Hide resolved
"media-src 'self' blob: data: https:",
"style-src 'self' 'unsafe-inline' https:"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looking at this, I wonder why HTTP would be fine for images but at the same time not for fonts, styles or other media.

I think, if the content security policy is changed, the change should be consistently applied to all kinds.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In this case the user can embed an Image from an HTTP-Server in the Docs. But users can't link any fonts etc. And I think we should use the most strict rules if possible.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes I also thought about it but i didn't want to open security breaches without a need for it. It seems unlikely someone will include a font in the markdown editor, i don't think it's even possible. What do you think?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sorry i didn't see @Its-treason response before so i agree to only allow images because they can be linked in the markdown editor

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Makes perfect sense. 👍
Maybe it's worth adding the reasoning to the code as an inline comment. 🙂

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Ok i can't now but i will later unless you can do it before.
Thanks

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I suggested a change because I can't directly edit the file.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment is added now.
Thanks.

];
Expand Down