From 2e27018a454ac96b2e80b4749b548bdac92078e5 Mon Sep 17 00:00:00 2001 From: Ivanq Date: Mon, 19 Aug 2019 20:19:15 +0000 Subject: [PATCH 1/2] Allow blob: protocol --- src/Ui/UiRequest.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Ui/UiRequest.py b/src/Ui/UiRequest.py index c68f48a03..da7b0e20e 100644 --- a/src/Ui/UiRequest.py +++ b/src/Ui/UiRequest.py @@ -259,7 +259,7 @@ def sendHeader(self, status=200, content_type="text/html", noscript=False, allow if noscript: headers["Content-Security-Policy"] = "default-src 'none'; sandbox allow-top-navigation allow-forms; img-src 'self'; font-src 'self'; media-src 'self'; style-src 'self' 'unsafe-inline';" elif script_nonce and self.isScriptNonceSupported(): - headers["Content-Security-Policy"] = "default-src 'none'; script-src 'nonce-{0}'; img-src 'self'; style-src 'self' 'unsafe-inline'; connect-src *; frame-src 'self'".format(script_nonce) + headers["Content-Security-Policy"] = "default-src 'none'; script-src 'nonce-{0}'; img-src 'self' 'blob:'; style-src 'self' 'blob:' 'unsafe-inline'; connect-src *; frame-src 'self' 'blob:'".format(script_nonce) if allow_ajax: headers["Access-Control-Allow-Origin"] = "null" From 43ca35865ddd61b3ba9a1dbb250fcbe97a94cc97 Mon Sep 17 00:00:00 2001 From: Ivanq Date: Tue, 20 Aug 2019 05:45:40 +0000 Subject: [PATCH 2/2] Fix quotes --- src/Ui/UiRequest.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/Ui/UiRequest.py b/src/Ui/UiRequest.py index da7b0e20e..cb31324d4 100644 --- a/src/Ui/UiRequest.py +++ b/src/Ui/UiRequest.py @@ -259,7 +259,7 @@ def sendHeader(self, status=200, content_type="text/html", noscript=False, allow if noscript: headers["Content-Security-Policy"] = "default-src 'none'; sandbox allow-top-navigation allow-forms; img-src 'self'; font-src 'self'; media-src 'self'; style-src 'self' 'unsafe-inline';" elif script_nonce and self.isScriptNonceSupported(): - headers["Content-Security-Policy"] = "default-src 'none'; script-src 'nonce-{0}'; img-src 'self' 'blob:'; style-src 'self' 'blob:' 'unsafe-inline'; connect-src *; frame-src 'self' 'blob:'".format(script_nonce) + headers["Content-Security-Policy"] = "default-src 'none'; script-src 'nonce-{0}'; img-src 'self' blob:; style-src 'self' blob: 'unsafe-inline'; connect-src *; frame-src 'self' blob:".format(script_nonce) if allow_ajax: headers["Access-Control-Allow-Origin"] = "null"