Projets/ObsiGate
1
1
Fork 0
Code Issues 16 Pull Requests Actions 1 Packages Projects Releases 16 Wiki Activity

feat: expand CSP connect-src directive and add async loading guard for highlight.js in popout view

Browse Source 
- Add cdnjs.cloudflare.com, fonts.googleapis.com, and fonts.gstatic.com to connect-src CSP directive
- Add waitForHljs helper function with 50 attempt limit and 100ms polling interval
- Check if hljs is defined before highlighting code blocks in popout view
- Fall back to async waiting if hljs not immediately available to prevent undefined reference errors
This commit is contained in:
bruno
2026-04-12 17:06:35 -04:00
parent ddb73461da
commit e1fcbe9ce7
2 changed files with 21 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
backend/main.py
+1 -1
View File
@@ -458,7 +458,7 @@ class SecurityHeadersMiddleware(BaseHTTPMiddleware):
"script-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://unpkg.com https://esm.sh; "
"style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com https://fonts.googleapis.com; "
"img-src 'self' data: blob:; "
"connect-src 'self' https://esm.sh https://unpkg.com; "
"connect-src 'self' https://esm.sh https://unpkg.com https://cdnjs.cloudflare.com https://fonts.googleapis.com https://fonts.gstatic.com; "
"font-src 'self' https://fonts.gstatic.com;"
)
return response