internal/middleware: allow arbitrary images in content-security-policy
At least temporarily, relax the content security policy to allow
arbitrary images, since this is currently breaking images in README
rendering.
Updates b/130541353
package middleware
import (
- "fmt"
"net/http"
"strings"
)
-var allowedExternalSrcs = []string{
- "fonts.googleapis.com",
- "fonts.gstatic.com",
+// policy is a helper for constructing content security policies.
+type policy struct {
+ directives []string
+}
+
+// add appends a new directive to the policy. Neither name nor values are
+// validated, and no checking is performed that the new directive is unique.
+func (p *policy) add(name string, values ...string) {
+ d := name + " " + strings.Join(values, " ")
+ p.directives = append(p.directives, d)
+}
+
+// serialize serializes the policy for use in the Content-Security-Policy
+// header.
+func (p *policy) serialize() string {
+ return strings.Join(p.directives, "; ")
}
// ContentSecurityPolicy adds a Content-Security-Policy header to all
// responses.
func ContentSecurityPolicy() Middleware {
- var b strings.Builder
- b.WriteString(fmt.Sprintf("default-src 'self' %s", strings.Join(allowedExternalSrcs, " ")))
- b.WriteString("; object-src 'none'")
- b.WriteString("; base-uri 'none'")
- csp := b.String()
+ var p policy
+ p.add("default-src", "'self'")
+ p.add("style-src", "'self'", "fonts.googleapis.com")
+ p.add("font-src", "'self'", "fonts.googleapis.com", "fonts.gstatic.com")
+ p.add("img-src", "*")
+ p.add("object-src 'none'")
+ p.add("base-uri 'none'")
+ csp := p.serialize()
return func(h http.Handler) http.Handler {
return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Security-Policy", csp)
