CSP fixes

AuthorKonata <konata@posteo.jp>
Date
Commit97defc1e42a6d383b3facea353c6e64464b1690b
Parent0e6d7d0
3 files changed, 15 insertions(+), 11 deletions(-)
Mpublic/assets/app.js
@@ -10,6 +10,16 @@ document.querySelectorAll("[data-confirm]").forEach((el) => {
1010 });
1111 });
1212
13+// Toggle visibility of a target element based on a checkbox:
14+// <input type="checkbox" data-toggle-target="some-id">
15+document.querySelectorAll("[data-toggle-target]").forEach((cb) => {
16+ const target = document.getElementById(cb.dataset.toggleTarget);
17+ if (!target) return;
18+ cb.addEventListener("change", () => {
19+ target.style.display = cb.checked ? "" : "none";
20+ });
21+});
22+
1323 // Paste-to-upload: paste an image anywhere on the settings page to fill the avatar input
1424 document.addEventListener("paste", (e) => {
1525 const input = document.querySelector('input[name="avatar"]');
Msrc/app.ts
@@ -17,12 +17,14 @@ import { syncStartup } from "./services/repoSync.ts";
1717
1818 const CSP = [
1919 "default-src 'self'",
20- "script-src 'self'",
20+ "script-src 'self' 'wasm-unsafe-eval'",
2121 "style-src 'self' 'unsafe-inline'",
22- "img-src 'self'",
22+ "img-src 'self' blob: data:",
2323 "connect-src 'self'",
24+ "worker-src blob:",
2425 "frame-ancestors 'none'",
2526 "form-action 'self'",
27+ "base-uri 'self'",
2628 "object-src 'none'",
2729 ].join("; ");
2830
Msrc/views/releases/NewRelease.tsx
@@ -61,6 +61,7 @@ export function NewRelease({ user, repo, error, values }: NewReleaseProps) {
6161 name="create_tag"
6262 value="on"
6363 checked={showTagFields}
64+ data-toggle-target="tag-fields-group"
6465 />
6566 <span>Create a git tag for this release</span>
6667 </label>
@@ -163,15 +164,6 @@ export function NewRelease({ user, repo, error, values }: NewReleaseProps) {
163164 </form>
164165 </div>
165166 </div>
166- <script>{`
167- (function() {
168- var cb = document.getElementById('create_tag');
169- var group = document.getElementById('tag-fields-group');
170- cb.addEventListener('change', function() {
171- group.style.display = cb.checked ? '' : 'none';
172- });
173- })();
174- `}</script>
175167 </Layout>
176168 );
177169 }