mirror of
https://github.com/discourse/discourse.git
synced 2026-08-06 13:08:40 +08:00
e7ce1e219eThe media-optimization worker is launched from a same-origin blob:
bootstrap that imports the real worker chunk by absolute URL. When
assets are served from a CDN, that import is fetched with a worker
destination and is therefore checked against worker-src (not
script-src), so strict-dynamic does not apply. With only `'self' blob:`,
the cross-origin CDN import is blocked:
```
Creating a worker from 'https://cdn/assets/.../entrypoint.digested.js' violates the following Content Security Policy directive: "worker-src 'self' blob:".
```
To fix, we add the asset host to worker-src so the worker chunk can be
imported on CDN/S3 deployments. Non-CDN deployments are unchanged
('self' blob:).
Unfortunately strict-dynamic is not consistently supported in
worker-src.
Followup to a32f09021f
50 lines
1.3 KiB
Ruby
Vendored
50 lines
1.3 KiB
Ruby
Vendored
# frozen_string_literal: true
|
|
require "content_security_policy"
|
|
|
|
class ContentSecurityPolicy
|
|
class Default
|
|
attr_reader :directives
|
|
|
|
def initialize
|
|
@directives =
|
|
{}.tap do |directives|
|
|
directives[:upgrade_insecure_requests] = [] if SiteSetting.force_https
|
|
directives[:base_uri] = [:self]
|
|
directives[:object_src] = [:none]
|
|
directives[:script_src] = script_src
|
|
directives[:worker_src] = worker_src
|
|
directives[:frame_ancestors] = frame_ancestors if restrict_embed?
|
|
directives[:manifest_src] = ["'self'"]
|
|
end
|
|
end
|
|
|
|
private
|
|
|
|
def script_src
|
|
%w['strict-dynamic' 'wasm-unsafe-eval']
|
|
end
|
|
|
|
def worker_src
|
|
[:self, "blob:", *worker_asset_host]
|
|
end
|
|
|
|
def worker_asset_host
|
|
if GlobalSetting.use_s3? && GlobalSetting.s3_cdn_url.present?
|
|
s3_cdn = GlobalSetting.s3_asset_cdn_url.presence || GlobalSetting.s3_cdn_url
|
|
["#{s3_cdn}/assets/"]
|
|
elsif GlobalSetting.cdn_url.present?
|
|
["#{GlobalSetting.cdn_url}#{Discourse.base_path}/assets/"]
|
|
else
|
|
[]
|
|
end
|
|
end
|
|
|
|
def frame_ancestors
|
|
["'self'", *EmbeddableHost.pluck(:host).map { |host| "https://#{host}" }]
|
|
end
|
|
|
|
def restrict_embed?
|
|
SiteSetting.content_security_policy_frame_ancestors && !SiteSetting.embed_any_origin
|
|
end
|
|
end
|
|
end
|
