eliott/ocis
1
0
Fork 0
mirror of https://github.com/owncloud/ocis synced 2026-04-25 17:25:21 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #12070 from paul43210/fix/csp-font-src

Browse Source 
fix(proxy): add data: to font-src CSP to allow bundled KaTeX fonts
This commit is contained in:
Martin
2026-03-11 08:47:29 +01:00
committed by GitHub
parent 4fba74c1f7 d4367fb224
commit c65dff7fac
11 changed files with 16 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
changelog/unreleased/fix-csp-font-src.md Normal file
View File

@@ -0,0 +1,5 @@
Bugfix: Fix CSP blocking bundled KaTeX font
The default Content Security Policy blocked the bundled KaTeX math font (used by the md-editor) because it is inlined as a `data:` URI in the Web UI CSS. Added `data:` to the `font-src` directive to resolve the console error on every page load. Users with custom CSP files (`PROXY_CSP_CONFIG_FILE_LOCATION`) will need to add `data:` to their `font-src` directive manually.
https://github.com/owncloud/ocis/pull/12070

1
deployments/examples/ocis_full/config/ocis/csp.yaml
View File

@@ -13,6 +13,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''self'''
frame-src:

1
deployments/examples/ocis_keycloak/config/ocis/csp.yaml
View File

@@ -11,6 +11,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''none'''
frame-src:

1
deployments/examples/ocis_multi/config/ocis/csp-ocm.yaml
View File

@@ -10,6 +10,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''self'''
frame-src:

1
deployments/examples/ocis_multi/config/ocis/csp.yaml
View File

@@ -11,6 +11,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''none'''
frame-src:

1
deployments/examples/ocis_ocm/config/ocis/csp-ocm-next.yaml
View File

@@ -9,6 +9,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''self'''
frame-src:

1
deployments/examples/ocis_ocm/config/ocis/csp-ocm.yaml
View File

@@ -9,6 +9,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''self'''
frame-src:

1
deployments/examples/ocis_ocm/config/ocis/csp.yaml
View File

@@ -9,6 +9,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''self'''
frame-src:

1
services/proxy/pkg/config/csp.yaml
View File

@@ -9,6 +9,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''self'''
frame-src:

4
tests/acceptance/features/coreApiWebdavOperations/downloadFile.feature
View File

@@ -219,7 +219,7 @@ Feature: download file
And the following headers should be set
| header | value |
| Content-Disposition | attachment; filename*=UTF-8''<encoded-file-name>; filename="<file-name>" |
| Content-Security-Policy | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
| Content-Security-Policy | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; default-src 'none'; font-src 'self' data:; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Permitted-Cross-Domain-Policies | none |
@@ -246,7 +246,7 @@ Feature: download file
And the following headers should be set
| header | value |
| Content-Disposition | attachment; filename*=UTF-8''%22quote%22double%22.txt; filename=""quote"double".txt" |
| Content-Security-Policy | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; default-src 'none'; font-src 'self'; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
| Content-Security-Policy | child-src 'self'; connect-src 'self' blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; default-src 'none'; font-src 'self' data:; frame-ancestors 'self'; frame-src 'self' blob: https://embed.diagrams.net/; img-src 'self' data: blob: https://raw.githubusercontent.com/owncloud/awesome-ocis/; manifest-src 'self'; media-src 'self'; object-src 'self' blob:; script-src 'self' 'unsafe-inline'; style-src 'self' 'unsafe-inline' |
| X-Content-Type-Options | nosniff |
| X-Frame-Options | SAMEORIGIN |
| X-Permitted-Cross-Domain-Policies | none |

1
tests/config/drone/csp.yaml
View File

@@ -11,6 +11,7 @@ directives:
- '''none'''
font-src:
- '''self'''
- 'data:'
frame-ancestors:
- '''none'''
frame-src: