Fix Content-Security-Policy (#1532)

* Add test for CDN in use by Swagger UI Signed-off-by: Marvin A. Ruder <[email protected]>
marvinruder · Aug 28, 2024 · 4432267 · 4432267
1 parent ef08833
commit 4432267
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/packages/backend/src/server.live.test.ts b/packages/backend/src/server.live.test.ts
@@ -19,7 +19,9 @@ tests.push({
   testName: "provides Swagger UI",
   testFunction: async () => {
     const res = await app.request("/api-docs");
+    const body = await res.text();
     expect(res.status).toBe(200);
     expect(res.headers.get("content-type")).toMatch("text/html");
+    expect(body).toContain("https://cdn.jsdelivr.net/npm/swagger-ui-dist/");
   },
 });
diff --git a/packages/backend/src/server.ts b/packages/backend/src/server.ts
@@ -107,9 +107,9 @@ app.use("/api-docs", async (c, next) => {
       "Content-Security-Policy",
       csp
         .replace("img-src ", "img-src blob: ")
-        .replace("script-src ", "script-src https://unpkg.com/swagger-ui-dist/ 'unsafe-inline' ")
-        .replace("style-src ", "style-src https://unpkg.com/swagger-ui-dist/ ")
-        .replace("style-src-elem ", "style-src-elem https://unpkg.com/swagger-ui-dist/ "),
+        .replace("script-src ", "script-src https://cdn.jsdelivr.net/npm/swagger-ui-dist/ 'unsafe-inline' ")
+        .replace("style-src ", "style-src https://cdn.jsdelivr.net/npm/swagger-ui-dist/ ")
+        .replace("style-src-elem ", "style-src-elem https://cdn.jsdelivr.net/npm/swagger-ui-dist/ "),
     );
   c.res.headers.set("Cross-Origin-Embedder-Policy", "unsafe-none");
   c.res.headers.set("Cross-Origin-Resource-Policy", "cross-origin");