jeudi 1 mars 2018

Changing the CSP of an Ember.js Addon Dummy App

I'm working on an ember addon leveraging PDF.js and ember-cli at version 2.18.2 and I'm noticing that PDF.js injects inline styles. The Content-Security-Policy-Report-Only header specifies style-src 'self'; which results in the logs of ember serve exploding with CSP violations being reported to the server via the report only uri with the following message:

Content Security Policy violation:

{
  "csp-report": {
    "document-uri": "http://localhost:4200/tests/index.html?testId=46b61910",
    "referrer": "http://localhost:4200/tests/index.html",
    "violated-directive": "style-src",
    "effective-directive": "style-src",
    "original-policy": "default-src 'none'; script-src 'self' localhost:7020 0.0.0.0:7020 undefined:7020; font-src 'self'; connect-src 'self' ws://localhost:7020 ws://0.0.0.0:7020 ws://undefined:7020 http://localhost:4200; img-src 'self'; style-src 'self'; media-src 'self'; report-uri http://localhost:4200/csp-report;",
    "disposition": "report",
    "blocked-uri": "inline",
    "line-number": 5270,
    "column-number": 23,
    "source-file": "http://localhost:4200/assets/test-support.js",
    "status-code": 200,
    "script-sample": ""
  }
}

Seeing as the applications we're building that will consume this addon control their own CSP and allows for inline styling, I'd like to disable these warnings but having difficulty tracking down how to do so.

Is it possible to customize the report-only CSP in an Ember.js addon's dummy app?




Aucun commentaire:

Enregistrer un commentaire