feat(prerender): Enable CSP for Activity Stream (#4211)

Fix Bug 1448359 - Switch Activity-Stream CSP on, including about:welcome
mozilla · Jun 22, 2018 · 8d599e1775483355b7e844e734faff55be33d525 · 8d599e1
1 parent 3e29130
commit 8d599e1775483355b7e844e734faff55be33d525
Unified Split

Showing with 1 addition and 1 deletion.

+1 −1 bin/render-activity-stream-html.js
diff --git a/bin/render-activity-stream-html.js b/bin/render-activity-stream-html.js
@@ -190,7 +190,7 @@ function templateHTML(options, html) {
 <html lang="${options.locale}" dir="${options.direction}">
   <head>
     <meta charset="utf-8">
-    <meta http-equiv="Content-Security-Policy-Report-Only" content="script-src 'unsafe-inline'; img-src http: https: data: blob:; style-src 'unsafe-inline'; child-src 'none'; object-src 'none'; report-uri https://tiles.services.mozilla.com/v4/links/activity-stream/csp">
+    <meta http-equiv="Content-Security-Policy" content="default-src 'none'; script-src 'unsafe-inline' resource: chrome:; connect-src https:; img-src https: data: blob:; style-src 'unsafe-inline';">
     <title>${options.strings.newtab_page_title}</title>
     <link rel="icon" type="image/png" href="chrome://branding/content/icon32.png"/>
     <link rel="stylesheet" href="chrome://browser/content/contentSearchUI.css" />