Add csp meta-tag support #650
Conversation
|
|
||
| attrs: { | ||
| 'http-equiv': 'Content-Security-Policy', | ||
| 'content': Object.keys(this.ctx.policies).map(function(name) { |
There was a problem hiding this comment.
This template wil never work in browser. According w3c, inserting meta tag in browser doesn't work.
There was a problem hiding this comment.
I'm not sure W3C can help us with
BEM.DOM.decl('page', {
onDoSomething: function() {
BEM.DOM.replace(this.domElem, BEMHTML.apply({
block: 'page',
content: { elem: 'csp' }
}));
}
});;)
There was a problem hiding this comment.
@alexbaumgertner Let's add deps from i-ecma__object, in 3.x it could be an issue.
There was a problem hiding this comment.
And i-ecma__array for map
alexbaumgertner
force-pushed
the
feature/csp
branch
2 times, most recently
from
c6a856f
to
685cf18
Compare
|
|
||
| ctx.policies = this.extend(defaultPolicies, ctx.policies); | ||
|
|
||
| // Параметр nonce распространяется только на <script> и <style>. |
There was a problem hiding this comment.
Can you please translate comments into English?
alexbaumgertner
force-pushed
the
feature/csp
branch
5 times, most recently
from
ccdd1c8
to
35f04a9
Compare
|
@tadatuta @mishaberezin Fixes |
alexbaumgertner
force-pushed
the
feature/csp
branch
from
ea823aa
to
5cc508e
Compare
alexbaumgertner
changed the title
|
@tadatuta Вова, посмотри финально, пожалуйста |
| @@ -1 +0,0 @@ | |||
| exports.baseLevelPath = require.resolve('bem-sets/levels/sets'); | |||
|
lgtm |
alexbaumgertner
force-pushed
the
feature/csp
branch
from
5cc508e
to
1bcc007
Compare
Add csp meta-tag support
|
|
||
| `nonce-$RANDOM` разрешает использовать инлайновый JavaScript (`<script>`) и инлайновый CSS (`<style>`), у которых атрибут `nonce` равен `$RANDOM`. Их содержимое не будет заблокировано даже при отсутствии ключевого слова `unsafe-inline`. | ||
|
|
||
| Передать свое значение `nonce` можно в поле элемента `csp` BEMJSON блока: |
There was a problem hiding this comment.
Передать свое значение
nonceможно в поле элементаcspBEMJSON блока
В примере ниже, показано что-то другое.
There was a problem hiding this comment.
@alexbaumgertner Саша, исправишь хотфиксом?
|
|
||
| Список источников в каждой директиве можно гибко настроить: | ||
|
|
||
| ```javacsript |
No description provided.