diff options
Diffstat (limited to 'themes/default/layouts/partials/base-csp.html')
| -rw-r--r-- | themes/default/layouts/partials/base-csp.html | 60 |
1 files changed, 22 insertions, 38 deletions
diff --git a/themes/default/layouts/partials/base-csp.html b/themes/default/layouts/partials/base-csp.html index 9519e14..55719d8 100644 --- a/themes/default/layouts/partials/base-csp.html +++ b/themes/default/layouts/partials/base-csp.html @@ -1,42 +1,26 @@ -{{ $upgrade := "" }} -{{ if .Site.Params.csp.upgrade }} - {{ $upgrade = "upgrade-insecure-requests;" }} -{{- end -}} +<meta name="referrer" content="{{ .Site.Params.site.referrer }}"> + +{{- if .Site.Params.csp }} -<meta name="referrer" content="{{ .Site.Params.csp.referrer }}"> +{{ + $policy := .Site.Params.csp + | jsonify + | replaceRE "\":\"\",\"" ";\n" + | replaceRE "{\"" "" + | replaceRE "\"],\"" ";\n" + | replaceRE "\",\"" " " + | replaceRE "\":\\[\"" " " + | replaceRE "\"]}" ";" + | replaceRE "\":\"\"}" ";" + | plainify +-}} {{ printf ` -<meta - http-equiv="Content-Security-Policy" - content=" - %s - block-all-mixed-content; - default-src 'self'; - child-src %s; - connect-src %s; - font-src %s; - form-action %s; - frame-src %s; - img-src %s; - media-src %s; - object-src %s; - prefetch-src %s; - script-src %s; - script-src-elem %s; - style-src %s; - ">` - ($upgrade) - (delimit .Site.Params.csp.childsrc " ") - (delimit .Site.Params.csp.connectsrc " ") - (delimit .Site.Params.csp.fontsrc " ") - (delimit .Site.Params.csp.formaction " ") - (delimit .Site.Params.csp.framesrc " ") - (delimit .Site.Params.csp.imgsrc " ") - (delimit .Site.Params.csp.mediasrc " ") - (delimit .Site.Params.csp.objectsrc " ") - (delimit .Site.Params.csp.prefetchsrc " ") - (delimit .Site.Params.csp.scriptsrc " ") - (delimit .Site.Params.csp.scriptsrcelem " ") - (delimit .Site.Params.csp.stylesrc " ") - | safeHTML }} +<meta http-equiv="Content-Security-Policy" content=" +%s +">` +$policy | safeHTML +}} + +{{- end -}} |