From 073d39ccbab63c85fad3476733d0541bdb7fb303 Mon Sep 17 00:00:00 2001 From: fen Date: Wed, 9 Sep 2026 21:18:53 -0500 Subject: [PATCH] Fix #116: allow inline styles in CSP (style-src 'self' 'unsafe-inline') --- internal/web/securityheaders_test.go | 2 +- internal/web/web.go | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/internal/web/securityheaders_test.go b/internal/web/securityheaders_test.go index b6d54c7..61d0b56 100644 --- a/internal/web/securityheaders_test.go +++ b/internal/web/securityheaders_test.go @@ -16,7 +16,7 @@ func TestSecurityHeaders(t *testing.T) { h := SecurityHeaders(pages) rec := httptest.NewRecorder() h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil)) - wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'" + wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'" if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP { t.Errorf("CSP = %q, want %q", got, wantCSP) } diff --git a/internal/web/web.go b/internal/web/web.go index fb12054..6d164ae 100644 --- a/internal/web/web.go +++ b/internal/web/web.go @@ -344,7 +344,7 @@ func SecurityHeaders(next http.Handler) http.Handler { // is harmless and arguably desirable. h := w.Header() h.Set("Content-Security-Policy", - "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'") + "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'") h.Set("Referrer-Policy", "no-referrer") h.Set("X-Content-Type-Options", "nosniff") next.ServeHTTP(w, r)