Allow jsdelivery cdn in csp header (#605)

123inkt · Jan 29, 2024 · 9617c50 · 9617c50
1 parent c93a128
commit 9617c50
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 3 deletions.
diff --git a/src/EventSubscriber/ContentSecurityPolicyResponseSubscriber.php b/src/EventSubscriber/ContentSecurityPolicyResponseSubscriber.php
@@ -24,7 +24,7 @@ public function onResponse(ResponseEvent $event): void
         // allow image svg+xml
         // allow websocket to connect to any port.
         $policy = [
-            "default-src 'self' https://cdn.jsdelivr.net/npm/bootstrap",
+            "default-src 'self' https://cdn.jsdelivr.net",
             "img-src 'self' data:",
             "object-src 'none'",
             "base-uri 'none'",

diff --git a/tests/Unit/EventSubscriber/ContentSecurityPolicyResponseSubscriberTest.php b/tests/Unit/EventSubscriber/ContentSecurityPolicyResponseSubscriberTest.php
@@ -40,7 +40,7 @@ public function testOnResponseWithIdeUrl(): void
         $subscriber->onResponse($event);
 
         static::assertSame(
-            "default-src 'self' https://cdn.jsdelivr.net/npm/bootstrap; img-src 'self' data:; object-src 'none'; base-uri 'none'; " .
+            "default-src 'self' https://cdn.jsdelivr.net; img-src 'self' data:; object-src 'none'; base-uri 'none'; " .
             "connect-src 'self' host:*; frame-src http://localhost:*",
             $response->headers->get("Content-Security-Policy")
         );
@@ -54,7 +54,7 @@ public function testOnResponseWithoutIdeUrl(): void
         $subscriber->onResponse($event);
 
         static::assertSame(
-            "default-src 'self' https://cdn.jsdelivr.net/npm/bootstrap; img-src 'self' data:; object-src 'none';" .
+            "default-src 'self' https://cdn.jsdelivr.net; img-src 'self' data:; object-src 'none';" .
             " base-uri 'none'; connect-src 'self' host:*",
             $response->headers->get("Content-Security-Policy")
         );