fix: Fixed CSP policy for commit page (#733)

JohnstonCode · Nov 11, 2019 · 6996ff0 · 6996ff0
1 parent e009428
commit 6996ff0
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/messages.ts b/src/messages.ts
@@ -78,7 +78,7 @@ async function showCommitInput(message?: string, filePaths?: string[]) {
   Use a content security policy to only allow loading images from https or from our extension directory,
   and only allow scripts that have a specific nonce.
   -->
-  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${panel.webview.cspSource} https:; script-src ${panel.webview.cspSource}; style-src ${panel.webview.cspSource};">
+  <meta http-equiv="Content-Security-Policy" content="default-src 'none'; img-src ${panel.webview.cspSource} https:; script-src ${panel.webview.cspSource} 'unsafe-inline'; style-src ${panel.webview.cspSource};">
 
   <title>Commit Message</title>
   <link rel="stylesheet" href="${styleUri}">