agusmakmun / agusmakmun/django-markdown-editor

The editor does not work when setting a Content Security Policy

Ouverte
#218 1 commentaire 1 réaction 0 personnes assignées Voir sur GitHub
Langage dominant
JavaScript
Étoiles
901
Forks
1.3k
Métriques de merge des PR
Aucune PR mergée en 30 j

Description

## Details

- OS (Operating System) version: Ubuntu
- Browser and browser version: Chromium & Firefox
- Django version: 4.1.7
- Martor version & theme: martor = 1.6.19

### Steps to reproduce

1. Set a CSP header on your webserver, e.g.: `add_header Content-Security-Policy "default-src 'self';`
2. Open a django admin page with a field with the markdown editor

In the Browser console you see the error:
ace.js:5 Refused to apply inline style because it violates the following Content Security Policy directive: "default-src 'self'". Either the 'unsafe-inline' keyword, a hash ('sha256-NPmOMJ6Koi743g0BGW8ul25dqdhwdyelDGzO4sWLPbE='), or a nonce ('nonce-...') is required to enable inline execution. Note also that 'style-src' was not explicitly set, so 'default-src' is used as a fallback.
and
Refused to load the image 'data:image/gif;base64,R0lGODlhAQABAAAAACH5BAEKAAEALAAAAAABAAEAAAICTAEAOw==' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'img-src' was not explicitly set, so 'default-src' is used as a fallback.

I expect the markdown editor work with security precautions in place.

Guide de contribution

Ouvrir le guide de contribution

Évaluation

Cette issue n'a pas encore été évaluée.

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.