From 7e12f9acf35c1048f1d1d98c20b348c202836a8c Mon Sep 17 00:00:00 2001 From: mfiano Date: Sun, 10 Aug 2025 08:25:58 -0400 Subject: [PATCH] =?UTF-8?q?=E2=99=BB=EF=B8=8F=20refactor:=20prevent=20HTML?= =?UTF-8?q?=20escaping=20of=20joined=20CSP=20strings=20(#553)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: kanuba --- templates/partials/content_security_policy.html | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/templates/partials/content_security_policy.html b/templates/partials/content_security_policy.html index 71ca50a..e8fa062 100644 --- a/templates/partials/content_security_policy.html +++ b/templates/partials/content_security_policy.html @@ -74,19 +74,19 @@ content="default-src 'self' {%- for domain in config.extra.allowed_domains -%} {%- if domain.directive == "connect-src" -%} - {%- set configured_connect_src = domain.domains | join(sep=' ') -%} + {%- set configured_connect_src = domain.domains | join(sep=' ') | safe -%} {%- set_global connect_src = connect_src ~ " " ~ configured_connect_src -%} {%- continue -%} {%- endif -%} {%- if domain.directive == "script-src" -%} - {%- set configured_script_src = domain.domains | join(sep=' ') -%} + {%- set configured_script_src = domain.domains | join(sep=' ') | safe -%} {%- set_global script_src = script_src ~ " " ~ configured_script_src -%} {%- continue -%} {%- endif -%} {#- Handle directives that are not connect-src -#} - {{ domain.directive }} {{ domain.domains | join(sep=' ') -}} + {{ domain.directive }} {{ domain.domains | join(sep=' ') | safe -}} {%- if domain.directive == "style-src" -%} {%- if utterances_enabled or hyvortalk_enabled or mermaid_enabled %} 'unsafe-inline'