poslop/palette
1
0
Fork 0
Code Issues 2 Pull Requests Actions Packages Projects Releases 2 Wiki Activity

Merge pull request 'Fix #116: allow inline styles in CSP (style-src)' (#117) from fix-116-csp-inline-styles into dev
CI / test (push) Successful in 22s
Details
CI / docker (push) Successful in 36s
Details

Browse Source
This commit was merged in pull request #117.
This commit is contained in:
fen
2026-09-10 02:20:53 +00:00
parent 9ec7d5152e 073d39ccba
commit aca99bc6d4
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/securityheaders_test.go
+1 -1
View File
@@ -16,7 +16,7 @@ func TestSecurityHeaders(t *testing.T) {
h := SecurityHeaders(pages)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest("GET", "/", nil))
wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
wantCSP := "default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'"
if got := rec.Header().Get("Content-Security-Policy"); got != wantCSP {
t.Errorf("CSP = %q, want %q", got, wantCSP)
}
internal/web/web.go
+1 -1
View File
@@ -344,7 +344,7 @@ func SecurityHeaders(next http.Handler) http.Handler {
// is harmless and arguably desirable.
h := w.Header()
h.Set("Content-Security-Policy",
"default-src 'self'; script-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
"default-src 'self'; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline'; frame-ancestors 'none'")
h.Set("Referrer-Policy", "no-referrer")
h.Set("X-Content-Type-Options", "nosniff")
next.ServeHTTP(w, r)