From f00e333010b04008038f4adec89a096ae9687c87 Mon Sep 17 00:00:00 2001 From: Tobias Bieniek Date: Thu, 9 Oct 2025 14:08:18 +0200 Subject: [PATCH] CSP: Add `https://raw.githubusercontent.com` to `connect-src` This is apparently needed for the workflow file verification to work on staging and production. --- src/config/server.rs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/config/server.rs b/src/config/server.rs index 07a5f493686..010dca68040 100644 --- a/src/config/server.rs +++ b/src/config/server.rs @@ -189,7 +189,7 @@ impl Server { // the `script` in `public/github-redirect.html` let content_security_policy = format!( "default-src 'self'; \ - connect-src 'self' *.ingest.sentry.io https://docs.rs https://play.rust-lang.org {cdn_domain}; \ + connect-src 'self' *.ingest.sentry.io https://docs.rs https://play.rust-lang.org https://raw.githubusercontent.com {cdn_domain}; \ script-src 'self' 'unsafe-eval' 'sha256-n1+BB7Ckjcal1Pr7QNBh/dKRTtBQsIytFodRiIosXdE=' 'sha256-dbf9FMl76C7BnK1CC3eWb3pvsQAUaTYSHAlBy9tNTG0='; \ style-src 'self' 'unsafe-inline' https://code.cdn.mozilla.net; \ font-src https://code.cdn.mozilla.net; \