From 8ab551f2859b05e13916b0739c96cb8f42430db8 Mon Sep 17 00:00:00 2001 From: Sunil Mohan Adapa Date: Mon, 29 Jun 2020 12:25:38 -0700 Subject: [PATCH] apache: Relax CSP to allow web workers for JSXC Closes: #1893. Signed-off-by: Sunil Mohan Adapa Reviewed-by: Veiko Aasa --- data/etc/apache2/conf-available/freedombox.conf | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/etc/apache2/conf-available/freedombox.conf b/data/etc/apache2/conf-available/freedombox.conf index 6e108ec18..7bf713dbf 100644 --- a/data/etc/apache2/conf-available/freedombox.conf +++ b/data/etc/apache2/conf-available/freedombox.conf @@ -26,7 +26,7 @@ RedirectMatch "^/freedombox" "/plinth" ## - , , tags are not allowed yet. ## - Allow JS from FreedomBox itself (no inline and attribute scripts). ## - Allow inline CSS and CSS files from Freedombox itself. -## - Web worker sources are disabled. +## - Web worker sources are allowed only from FreedomBox itself (for JSXC). ## - All other fetch sources including Ajax are not allowed from FreedomBox ## itself. ## - tag is not allowed. @@ -46,7 +46,7 @@ RedirectMatch "^/freedombox" "/plinth" ## Header set Referrer-Policy 'same-origin' - Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'none'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-forms allow-same-origin; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" + Header set Content-Security-Policy "font-src 'self'; frame-src 'none'; img-src 'self'; manifest-src 'none'; media-src 'none'; object-src 'none'; script-src 'self'; style-src 'self' 'unsafe-inline'; worker-src 'self'; default-src 'self'; base-uri 'none'; sandbox allow-scripts allow-popups allow-forms allow-same-origin; form-action 'self'; frame-ancestors 'none'; block-all-mixed-content;" Header set X-Content-Type-Options 'nosniff'