Drawio image

docs/example-advanced.nginx.conf

@@ -166,11 +166,6 @@ server {
     # We've applied other sandboxing techniques to mitigate the risk of running WebAssembly in this privileged scope
     if ($uri ~ ^\/unsafeiframe\/inner\.html.*$) { set $unsafe 1; }
 
-    # draw.io uses inline script tags in it's index.html. The hashes are added here.
-    if ($uri ~ ^\/components\/drawio\/src\/main\/webapp\/index.html.*$) {
-        set $scriptSrc "'self' 'sha256-dLMFD7ijAw6AVaqecS7kbPcFFzkxQ+yeZSsKpOdLxps=' 'sha256-6g514VrT/cZFZltSaKxIVNFF46+MFaTSDTPB8WfYK+c=' resource: https://${main_domain}";
-    }
-
     # privileged contexts allow a few more rights than unprivileged contexts, though limits are still applied
     if ($unsafe) {
         set $scriptSrc "'self' 'unsafe-eval' 'unsafe-inline' resource: https://${main_domain}";

lib/defaults.js

@@ -52,10 +52,6 @@ Default.padContentSecurity = function (Env) {
     return (Default.commonCSP(Env).join('; ') + "script-src 'self' 'unsafe-eval' 'unsafe-inline' resource: " + Env.httpUnsafeOrigin).replace(/\s+/g, ' ');
 };
 
-Default.diagramContentSecurity = function (Env) {
-    return (Default.commonCSP(Env).join('; ') + "script-src 'self' 'sha256-dLMFD7ijAw6AVaqecS7kbPcFFzkxQ+yeZSsKpOdLxps=' 'sha256-6g514VrT/cZFZltSaKxIVNFF46+MFaTSDTPB8WfYK+c=' resource: " + Env.httpUnsafeOrigin).replace(/\s+/g, ' ');
-};
-
 Default.httpHeaders = function (Env) {
     return {
         "X-XSS-Protection": "1; mode=block",

lib/http-worker.js

@@ -127,8 +127,6 @@ var getHeaders = function (Env, type) {
     var csp;
     if (type === 'office') {
         csp = Default.padContentSecurity(Env);
-    } else if (type === 'diagram') {
-        csp = Default.diagramContentSecurity(Env);
     } else {
         csp = Default.contentSecurity(Env);
     }
@@ -151,8 +149,6 @@ var setHeaders = function (req, res) {
         type = 'office';
     } else if (/^\/api\/(broadcast|config)/.test(req.url)) {
         type = 'api';
-    } else if (/^\/components\/drawio\/src\/main\/webapp\/index.html.*$/.test(req.url)) {
-        type = 'diagram';
     } else {
         type = 'standard';
     }