Skip to content

Commit 74f4269

Browse files
chagongchagong
authored
fix: Add Content-Security-Policy to webviews (#171) (#1648)
1 parent 3e9cbb0 commit 74f4269

8 files changed

Lines changed: 16 additions & 0 deletions

File tree

‎src/beginner-tips/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -109,11 +109,13 @@ class BeginnerTipsPage {
109109

110110
// Use a nonce to whitelist which scripts can be run
111111
const nonce = getNonce();
112+
const cspSource = this._panel!.webview.cspSource;
112113

113114
return `<!DOCTYPE html>
114115
<html lang="en">
115116
<head>
116117
<meta charset="utf-8">
118+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
117119
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
118120
<meta name="theme-color" content="#000000">
119121
<title>${WEBVIEW_TITLE}</title>

‎src/ext-guide/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -74,10 +74,12 @@ function getHtmlForWebview(webviewPanel: vscode.WebviewPanel, scriptPath: string
7474

7575
// Use a nonce to whitelist which scripts can be run
7676
const nonce = getNonce();
77+
const cspSource = webviewPanel.webview.cspSource;
7778
return `<!DOCTYPE html>
7879
<html lang="en">
7980
<head>
8081
<meta charset="utf-8">
82+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
8183
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
8284
<meta name="theme-color" content="#000000">
8385
<title>Java Extensions Guide</title>

‎src/formatter-settings/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -158,10 +158,12 @@ export class JavaFormatterSettingsEditorProvider implements vscode.CustomTextEdi
158158

159159
// Use a nonce to whitelist which scripts can be run
160160
const nonce = getNonce();
161+
const cspSource = this.webviewPanel!.webview.cspSource;
161162
return `<!DOCTYPE html>
162163
<html lang="en">
163164
<head>
164165
<meta charset="utf-8">
166+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
165167
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
166168
<meta name="theme-color" content="#000000">
167169
<title>Java Formatter Settings</title>

‎src/install-jdk/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -143,11 +143,13 @@ class InstallJdkPage {
143143

144144
// Use a nonce to whitelist which scripts can be run
145145
const nonce = getNonce();
146+
const cspSource = this._panel!.webview.cspSource;
146147

147148
return `<!DOCTYPE html>
148149
<html lang="en">
149150
<head>
150151
<meta charset="utf-8">
152+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
151153
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
152154
<meta name="theme-color" content="#000000">
153155
<title>React App</title>

‎src/java-runtime/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -165,11 +165,13 @@ function getHtmlForWebview(webviewPanel: vscode.WebviewPanel, scriptPath: string
165165

166166
// Use a nonce to whitelist which scripts can be run
167167
const nonce = getNonce();
168+
const cspSource = webviewPanel.webview.cspSource;
168169

169170
return `<!DOCTYPE html>
170171
<html lang="en">
171172
<head>
172173
<meta charset="utf-8">
174+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
173175
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
174176
<meta name="theme-color" content="#000000">
175177
<title>Configure Java Runtime</title>

‎src/overview/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,11 +114,13 @@ function getHtmlForWebview(webviewPanel: vscode.WebviewPanel, scriptPath: string
114114

115115
// Use a nonce to whitelist which scripts can be run
116116
const nonce = getNonce();
117+
const cspSource = webviewPanel.webview.cspSource;
117118

118119
return `<!DOCTYPE html>
119120
<html lang="en">
120121
<head>
121122
<meta charset="utf-8">
123+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
122124
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
123125
<meta name="theme-color" content="#000000">
124126
<title>Java Overview</title>

‎src/project-settings/projectSettingsView.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -195,10 +195,12 @@ class ProjectSettingView {
195195

196196
// Use a nonce to whitelist which scripts can be run
197197
const nonce = getNonce();
198+
const cspSource = webview.cspSource;
198199
return `<!DOCTYPE html>
199200
<html lang="en">
200201
<head>
201202
<meta charset="utf-8">
203+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
202204
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
203205
<meta name="theme-color" content="#000000">
204206
<title>Project Settings</title>

‎src/welcome/index.ts‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -104,10 +104,12 @@ function getHtmlForWebview(webviewPanel: vscode.WebviewPanel, scriptPath: string
104104

105105
// Use a nonce to whitelist which scripts can be run
106106
const nonce = getNonce();
107+
const cspSource = webviewPanel.webview.cspSource;
107108
return `<!DOCTYPE html>
108109
<html lang="en">
109110
<head>
110111
<meta charset="utf-8">
112+
<meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${cspSource} https: data:; script-src 'nonce-${nonce}'; style-src ${cspSource} 'unsafe-inline'; font-src ${cspSource} https: data:;">
111113
<meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no">
112114
<meta name="theme-color" content="#000000">
113115
<title>Java Help Center</title>

0 commit comments

Comments
 (0)