From 522df6e91a937e02fba018a0276bb1561fd40e3d Mon Sep 17 00:00:00 2001 From: Kyle Spearrin Date: Tue, 31 Jan 2023 16:21:06 -0500 Subject: [PATCH] add wasm-unsafe-eval to CSP (#2656) --- docker-unified/hbs/nginx-config.hbs | 2 +- util/Setup/Configuration.cs | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/docker-unified/hbs/nginx-config.hbs b/docker-unified/hbs/nginx-config.hbs index 3698c89af5..5b57673f1c 100644 --- a/docker-unified/hbs/nginx-config.hbs +++ b/docker-unified/hbs/nginx-config.hbs @@ -57,7 +57,7 @@ server { include /etc/nginx/security-headers-ssl.conf; {{/if}} include /etc/nginx/security-headers.conf; - add_header Content-Security-Policy "{{{String.Coalesce env.BW_CSP "default-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://haveibeenpwned.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory; object-src 'self' blob:;"}}}"; + add_header Content-Security-Policy "{{{String.Coalesce env.BW_CSP "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: https://haveibeenpwned.com; child-src 'self' https://*.duosecurity.com https://*.duofederal.com; frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; connect-src 'self' https://api.pwnedpasswords.com https://api.2fa.directory; object-src 'self' blob:;"}}}"; add_header X-Frame-Options SAMEORIGIN; add_header X-Robots-Tag "noindex, nofollow"; } diff --git a/util/Setup/Configuration.cs b/util/Setup/Configuration.cs index 36f82ea4f5..bfe7b10d31 100644 --- a/util/Setup/Configuration.cs +++ b/util/Setup/Configuration.cs @@ -76,8 +76,9 @@ public class Configuration [Description("Nginx Header Content-Security-Policy parameter\n" + "WARNING: Reconfiguring this parameter may break features. By changing this parameter\n" + "you become responsible for maintaining this value.")] - public string NginxHeaderContentSecurityPolicy { get; set; } = "default-src 'self'; style-src 'self' " + - "'unsafe-inline'; img-src 'self' data: https://haveibeenpwned.com; " + + public string NginxHeaderContentSecurityPolicy { get; set; } = "default-src 'self'; " + + "script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; " + + "img-src 'self' data: https://haveibeenpwned.com; " + "child-src 'self' https://*.duosecurity.com https://*.duofederal.com; " + "frame-src 'self' https://*.duosecurity.com https://*.duofederal.com; " + "connect-src 'self' wss://{0} https://api.pwnedpasswords.com " +