From 2d141d74ede7da60bc2b44d9f11900b3b39702cb Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= Date: Thu, 9 Jun 2022 18:32:35 +0200 Subject: [PATCH 1/2] Fix CSP CKeditor directives missing semi colon --- app/Http/Middleware/SecureHeaders.php | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/app/Http/Middleware/SecureHeaders.php b/app/Http/Middleware/SecureHeaders.php index 7336460..5306e54 100644 --- a/app/Http/Middleware/SecureHeaders.php +++ b/app/Http/Middleware/SecureHeaders.php @@ -44,11 +44,11 @@ class SecureHeaders $response->headers->set('Strict-Transport-Security', 'max-age=31536000; includeSubDomains;'); $cspPolicies = [ // * CKEDITOR Specific https://ckeditor.com/docs/ckeditor5/latest/installation/advanced/csp.html - "connect-src 'self'", - "img-src * data:", - "frame-src *", + "connect-src 'self';", + "img-src * data:;", + "frame-src *;", - "font-src 'self'", + "font-src 'self';", // phpcs:ignore Generic.Files.LineLength.TooLong "style-src 'self' https: 'nonce-$nonce' https://fonts.googleapis.com;", // phpcs:ignore Generic.Files.LineLength.TooLong From b13059715d3556097de5e1f4fe321f59af7baeb6 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?J=C3=A9r=C3=A9my=20Munsch?= Date: Thu, 9 Jun 2022 18:51:40 +0200 Subject: [PATCH 2/2] Revert to unsafe inline force by vuejs style loader https://github.com/vuejs/vue-style-loader/issues/33 --- app/Http/Middleware/SecureHeaders.php | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/app/Http/Middleware/SecureHeaders.php b/app/Http/Middleware/SecureHeaders.php index 5306e54..c0c4d7f 100644 --- a/app/Http/Middleware/SecureHeaders.php +++ b/app/Http/Middleware/SecureHeaders.php @@ -48,9 +48,10 @@ class SecureHeaders "img-src * data:;", "frame-src *;", - "font-src 'self';", + "font-src 'self' https://fonts.gstatic.com;", + // ! reverted since https://github.com/vuejs/vue-style-loader/issues/33 // phpcs:ignore Generic.Files.LineLength.TooLong - "style-src 'self' https: 'nonce-$nonce' https://fonts.googleapis.com;", + "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com;", // phpcs:ignore Generic.Files.LineLength.TooLong "script-src 'self' https: $jsDev https://cdnjs.cloudflare.com;" ];