Merge pull request #15654 from opf/fix-csop-for-lookbook

Fix ContentSecurityPolicy for lookbook
opf · May 23, 2024 · d94691e · d94691e
2 parents 068a88d + 3798b41
commit d94691e
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/config/initializers/lookbook.rb b/config/initializers/lookbook.rb
@@ -18,14 +18,17 @@
   ]
 
   # Show pages first, then previews
-  config.lookbook.preview_inspector.sidebar_panels = [:pages, :previews]
+  config.lookbook.preview_inspector.sidebar_panels = %i[pages previews]
   # Show notes first, all other panels next
   config.lookbook.preview_inspector.drawer_panels = [:notes, "*"]
   config.lookbook.ui_theme = "blue"
 
   SecureHeaders::Configuration.named_append(:lookbook) do
     {
-      script_src: %w('unsafe-eval' 'unsafe-inline') # rubocop:disable Lint/PercentStringArray
+      script_src: %w('unsafe-eval' 'unsafe-inline' 'self'), # rubocop:disable Lint/PercentStringArray
+      script_src_elem: %w('unsafe-eval' 'unsafe-inline' 'self'), # rubocop:disable Lint/PercentStringArray
+      style_src: %w('self' 'unsafe-inline'), # rubocop:disable Lint/PercentStringArray
+      style_src_attr: %w('self' 'unsafe-inline') # rubocop:disable Lint/PercentStringArray
     }
   end