add content security policy#7181
Conversation
| <head> | ||
| <meta charset="utf-8"> | ||
| <meta name="viewport" content="width=device-width,initial-scale=1,shrink-to-fit=no"> | ||
| <meta http-equiv="Content-Security-Policy" content="default-src 'unsafe-inline' 'unsafe-eval' vscode-resource: data: https: http:;"> |
There was a problem hiding this comment.
Relevant docs:
https://code.visualstudio.com/api/extension-guides/webview#content-security-policy
https://developers.google.com/web/fundamentals/security/csp/
Right now this CSP is very lenient. While it might be good to revisit this, everything currently specified in here is required for our window to work, with one possible exception. That exception is the http: allowance. For example if you do something like Bokeh you'll get warnings if you don't allow https so that it can hit scripts from https://cdn.pydata.org/bokeh. I don't know for sure that http: is required, but given that packages can hit just about anything to load scripts it seems unsafe to disallow http:. While this CSP is lenient I believe that is in step with the overall jupyter ecosystem.
Codecov Report
@@ Coverage Diff @@
## master #7181 +/- ##
==========================================
- Coverage 58.5% 58.44% -0.06%
==========================================
Files 485 485
Lines 21446 21446
Branches 3462 3462
==========================================
- Hits 12546 12535 -11
- Misses 8122 8135 +13
+ Partials 778 776 -2
Continue to review full report at Codecov.
|
3 participants
For #7007
package-lock.jsonhas been regenerated by runningnpm install(if dependencies have changed)