From f77cf306438f0bbcc5d6ed64028d95cf16a4c723 Mon Sep 17 00:00:00 2001 From: Eric Amodio Date: Fri, 9 Jul 2021 02:13:52 -0400 Subject: [PATCH] Adds better webview security --- CHANGELOG.md | 4 ++ src/webviews/apps/rebase/rebase.html | 2 +- src/webviews/apps/settings/settings.html | 2 +- src/webviews/apps/welcome/welcome.html | 2 +- src/webviews/rebaseEditor.ts | 39 ++++++++++---- src/webviews/settingsWebview.ts | 2 +- src/webviews/webviewBase.ts | 51 ++++++++++++------ src/webviews/welcomeWebview.ts | 2 +- webpack.config.js | 67 ++++++++++-------------- 9 files changed, 102 insertions(+), 69 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 45237de6001d0..6beb60577ccb7 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -11,6 +11,10 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/) and this p - Adds new _Open Previous Changes with Working File_ command to commit files in views — closes [#1529](https://github.com/eamodio/vscode-gitlens/issues/1529) - Adopts new vscode `createStatusBarItem` API to allow for independent toggling — closes [#1543](https://github.com/eamodio/vscode-gitlens/issues/1543) +### Changed + +- Dynamically generates hashes and nonces for webview script and style tags for better + ### Fixed - Fixes [#1432](https://github.com/eamodio/vscode-gitlens/issues/1432) - Unhandled Timeout Promise diff --git a/src/webviews/apps/rebase/rebase.html b/src/webviews/apps/rebase/rebase.html index a10a0ed0b3efa..ff1b977ba76cc 100644 --- a/src/webviews/apps/rebase/rebase.html +++ b/src/webviews/apps/rebase/rebase.html @@ -2,7 +2,7 @@ -