delroth/hydra
0
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

web: serveFile: also serve a CSP putting served HTML in its own origin

Browse source
This commit is contained in:
Pierre Bourdon 2024-04-21 16:14:24 +02:00 committed by Janne Heß
parent 8b48579593
commit b72528be50
No known key found for this signature in database
1 changed files with 3 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
src/lib/Hydra/Controller/Build.pm
View file

@ -234,6 +234,9 @@ sub serveFile {
} }
elsif ($ls->{type} eq "regular") { elsif ($ls->{type} eq "regular") {
# Have the hosted data considered its own origin to avoid being a giant
# XSS hole.
$c->response->header('Content-Security-Policy' => 'sandbox allow-scripts');
$c->stash->{'plain'} = { data => grab(cmd => ["nix", "--experimental-features", "nix-command", $c->stash->{'plain'} = { data => grab(cmd => ["nix", "--experimental-features", "nix-command",
"store", "cat", "--store", getStoreUri(), "$path"]) }; "store", "cat", "--store", getStoreUri(), "$path"]) };