Merge pull request #42399 from bubba/applicationcontroller-self-csp

Add 'self' to Rails::ApplicationController Content-Security-Policy
2021-06-06 22:19:02 +01:00 · 2021-06-06 22:19:02 +01:00 · 01d836fcf3
parent 0b07e33c10 928b3f4f0a
commit 01d836fcf3
1 changed files with 2 additions and 2 deletions
--- a/railties/lib/rails/application_controller.rb
+++ b/railties/lib/rails/application_controller.rb
@ -7,8 +7,8 @@ class Rails::ApplicationController < ActionController::Base # :nodoc:
  before_action :disable_content_security_policy_nonce!

  content_security_policy do |policy|
-    policy.script_src :unsafe_inline
-    policy.style_src :unsafe_inline
+    policy.script_src :self, :unsafe_inline
+    policy.style_src :self, :unsafe_inline
  end

  private