diff options
| author | Rafael França <rafaelmfranca@gmail.com> | 2018-04-12 16:10:43 -0400 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-04-12 16:10:43 -0400 |
| commit | 23d4091a1f9ef4693050823264fc1b6d345f1b7a (patch) | |
| tree | e1c58e2568112324254508a15ca9e93d945e2d10 | |
| parent | f6d3d96dfe6a90935620b2bdc3b31e6a7f124b2a (diff) | |
| parent | 01d857b09ae22174d5101a03b424829a876cc4bd (diff) | |
| download | rails-23d4091a1f9ef4693050823264fc1b6d345f1b7a.tar.gz rails-23d4091a1f9ef4693050823264fc1b6d345f1b7a.tar.bz2 rails-23d4091a1f9ef4693050823264fc1b6d345f1b7a.zip | |
Merge pull request #32549 from stephensolis/csp-websockets
Add WebSocket URI support to CSP DSL mappings
| -rw-r--r-- | actionpack/lib/action_dispatch/http/content_security_policy.rb | 4 | ||||
| -rw-r--r-- | actionpack/test/dispatch/content_security_policy_test.rb | 6 |
2 files changed, 9 insertions, 1 deletions
diff --git a/actionpack/lib/action_dispatch/http/content_security_policy.rb b/actionpack/lib/action_dispatch/http/content_security_policy.rb index a3407c9698..c1f80a1ffc 100644 --- a/actionpack/lib/action_dispatch/http/content_security_policy.rb +++ b/actionpack/lib/action_dispatch/http/content_security_policy.rb @@ -113,7 +113,9 @@ module ActionDispatch #:nodoc: blob: "blob:", filesystem: "filesystem:", report_sample: "'report-sample'", - strict_dynamic: "'strict-dynamic'" + strict_dynamic: "'strict-dynamic'", + ws: "ws:", + wss: "wss:" }.freeze DIRECTIVES = { diff --git a/actionpack/test/dispatch/content_security_policy_test.rb b/actionpack/test/dispatch/content_security_policy_test.rb index f133aae865..95fce39dad 100644 --- a/actionpack/test/dispatch/content_security_policy_test.rb +++ b/actionpack/test/dispatch/content_security_policy_test.rb @@ -51,6 +51,12 @@ class ContentSecurityPolicyTest < ActiveSupport::TestCase @policy.script_src :strict_dynamic assert_equal "script-src 'strict-dynamic'", @policy.build + @policy.script_src :ws + assert_equal "script-src ws:", @policy.build + + @policy.script_src :wss + assert_equal "script-src wss:", @policy.build + @policy.script_src :none, :report_sample assert_equal "script-src 'none' 'report-sample'", @policy.build end |