(config *Config, nonce string, others ...webui.ContentSecurityPolicy)
| 90 | } |
| 91 | |
| 92 | func generateConsoleCSPString(config *Config, nonce string, others ...webui.ContentSecurityPolicy) string { |
| 93 | baseURLs := webui.RewriteSchemes( |
| 94 | webui.WebsocketSchemeRewrites, |
| 95 | config.UI.StackConfig.GS.BaseURL, |
| 96 | config.UI.StackConfig.IS.BaseURL, |
| 97 | config.UI.StackConfig.JS.BaseURL, |
| 98 | config.UI.StackConfig.NS.BaseURL, |
| 99 | config.UI.StackConfig.AS.BaseURL, |
| 100 | config.UI.StackConfig.EDTC.BaseURL, |
| 101 | config.UI.StackConfig.QRG.BaseURL, |
| 102 | config.UI.StackConfig.GCS.BaseURL, |
| 103 | config.UI.StackConfig.DCS.BaseURL, |
| 104 | ) |
| 105 | return webui.ContentSecurityPolicy{ |
| 106 | ConnectionSource: append([]string{ |
| 107 | "'self'", |
| 108 | config.UI.SentryDSN, |
| 109 | config.UI.StatusPage, |
| 110 | "gravatar.com", |
| 111 | "www.gravatar.com", |
| 112 | }, baseURLs...), |
| 113 | StyleSource: []string{ |
| 114 | "'self'", |
| 115 | config.UI.AssetsBaseURL, |
| 116 | config.UI.BrandingBaseURL, |
| 117 | "'unsafe-inline'", |
| 118 | }, |
| 119 | ScriptSource: []string{ |
| 120 | "'self'", |
| 121 | config.UI.AssetsBaseURL, |
| 122 | config.UI.BrandingBaseURL, |
| 123 | "'unsafe-eval'", |
| 124 | "'strict-dynamic'", |
| 125 | fmt.Sprintf("'nonce-%s'", nonce), |
| 126 | }, |
| 127 | BaseURI: []string{ |
| 128 | "'self'", |
| 129 | }, |
| 130 | FrameAncestors: []string{ |
| 131 | "'none'", |
| 132 | }, |
| 133 | }.Merge(others...).Clean().String() |
| 134 | } |
| 135 | |
| 136 | // RegisterRoutes implements web.Registerer. It registers the Console to the web server. |
| 137 | func (console *Console) RegisterRoutes(server *web.Server) { |
no test coverage detected