From 5c886a4e100eff984db563d2e9f4a4111153b775 Mon Sep 17 00:00:00 2001 From: Thibaut Courouble Date: Sun, 21 Oct 2018 17:41:01 -0400 Subject: [PATCH] Remove http:// URLs from CSP --- lib/app.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/lib/app.rb b/lib/app.rb index 8715fc93..bc80c62a 100644 --- a/lib/app.rb +++ b/lib/app.rb @@ -69,7 +69,7 @@ class App < Sinatra::Application set :static, false set :cdn_origin, 'https://cdn.devdocs.io' set :docs_origin, '//docs.devdocs.io' - set :csp, "default-src 'self' *; script-src 'self' 'nonce-devdocs' http://cdn.devdocs.io https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es http://*.jquery.com https://*.jquery.com; font-src 'none'; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;" + set :csp, "default-src 'self' *; script-src 'self' 'nonce-devdocs' https://cdn.devdocs.io https://www.google-analytics.com https://secure.gaug.es https://*.jquery.com; font-src 'none'; style-src 'self' 'unsafe-inline' *; img-src 'self' * data:;" use Rack::ConditionalGet use Rack::ETag