CSP fixes
Mpublic/assets/app.js
| @@ -10,6 +10,16 @@ document.querySelectorAll("[data-confirm]").forEach((el) => { | |||
|---|---|---|---|
| 10 | 10 | }); | |
| 11 | 11 | }); | |
| 12 | 12 | ||
| 13 | + | // Toggle visibility of a target element based on a checkbox: | |
| 14 | + | // <input type="checkbox" data-toggle-target="some-id"> | |
| 15 | + | document.querySelectorAll("[data-toggle-target]").forEach((cb) => { | |
| 16 | + | const target = document.getElementById(cb.dataset.toggleTarget); | |
| 17 | + | if (!target) return; | |
| 18 | + | cb.addEventListener("change", () => { | |
| 19 | + | target.style.display = cb.checked ? "" : "none"; | |
| 20 | + | }); | |
| 21 | + | }); | |
| 22 | + | ||
| 13 | 23 | // Paste-to-upload: paste an image anywhere on the settings page to fill the avatar input | |
| 14 | 24 | document.addEventListener("paste", (e) => { | |
| 15 | 25 | const input = document.querySelector('input[name="avatar"]'); | |
Msrc/app.ts
| @@ -17,12 +17,14 @@ import { syncStartup } from "./services/repoSync.ts"; | |||
|---|---|---|---|
| 17 | 17 | ||
| 18 | 18 | const CSP = [ | |
| 19 | 19 | "default-src 'self'", | |
| 20 | - | "script-src 'self'", | |
| 20 | + | "script-src 'self' 'wasm-unsafe-eval'", | |
| 21 | 21 | "style-src 'self' 'unsafe-inline'", | |
| 22 | - | "img-src 'self'", | |
| 22 | + | "img-src 'self' blob: data:", | |
| 23 | 23 | "connect-src 'self'", | |
| 24 | + | "worker-src blob:", | |
| 24 | 25 | "frame-ancestors 'none'", | |
| 25 | 26 | "form-action 'self'", | |
| 27 | + | "base-uri 'self'", | |
| 26 | 28 | "object-src 'none'", | |
| 27 | 29 | ].join("; "); | |
| 28 | 30 | ||
Msrc/views/releases/NewRelease.tsx
| @@ -61,6 +61,7 @@ export function NewRelease({ user, repo, error, values }: NewReleaseProps) { | |||
|---|---|---|---|
| 61 | 61 | name="create_tag" | |
| 62 | 62 | value="on" | |
| 63 | 63 | checked={showTagFields} | |
| 64 | + | data-toggle-target="tag-fields-group" | |
| 64 | 65 | /> | |
| 65 | 66 | <span>Create a git tag for this release</span> | |
| 66 | 67 | </label> | |
| @@ -163,15 +164,6 @@ export function NewRelease({ user, repo, error, values }: NewReleaseProps) { | |||
|---|---|---|---|
| 163 | 164 | </form> | |
| 164 | 165 | </div> | |
| 165 | 166 | </div> | |
| 166 | - | <script>{` | |
| 167 | - | (function() { | |
| 168 | - | var cb = document.getElementById('create_tag'); | |
| 169 | - | var group = document.getElementById('tag-fields-group'); | |
| 170 | - | cb.addEventListener('change', function() { | |
| 171 | - | group.style.display = cb.checked ? '' : 'none'; | |
| 172 | - | }); | |
| 173 | - | })(); | |
| 174 | - | `}</script> | |
| 175 | 167 | </Layout> | |
| 176 | 168 | ); | |
| 177 | 169 | } | |