diff options
| author | Andrew White <pixeltrix@users.noreply.github.com> | 2018-10-23 07:35:51 +0100 |
|---|---|---|
| committer | GitHub <noreply@github.com> | 2018-10-23 07:35:51 +0100 |
| commit | 759b3af0c6fc9fb502031a05b281736602ff8e5f (patch) | |
| tree | 97962a0b7a59310e2299da20dd94c5d39a1b74d1 /actionpack/lib | |
| parent | c2f8df67f34e233ff3f7f058d492217c5ad3eff1 (diff) | |
| parent | a150a026591b7b9dcaba5a2ef5fce02f7d990aba (diff) | |
| download | rails-759b3af0c6fc9fb502031a05b281736602ff8e5f.tar.gz rails-759b3af0c6fc9fb502031a05b281736602ff8e5f.tar.bz2 rails-759b3af0c6fc9fb502031a05b281736602ff8e5f.zip | |
Merge pull request #34286 from rails/fix-csp-dynamic-sources
Fix CSP dynamic sources
Diffstat (limited to 'actionpack/lib')
| -rw-r--r-- | actionpack/lib/action_dispatch/http/content_security_policy.rb | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/actionpack/lib/action_dispatch/http/content_security_policy.rb b/actionpack/lib/action_dispatch/http/content_security_policy.rb index 50953e32b5..b1e5a28be5 100644 --- a/actionpack/lib/action_dispatch/http/content_security_policy.rb +++ b/actionpack/lib/action_dispatch/http/content_security_policy.rb @@ -22,7 +22,8 @@ module ActionDispatch #:nodoc: if policy = request.content_security_policy nonce = request.content_security_policy_nonce - headers[header_name(request)] = policy.build(request.controller_instance, nonce) + context = request.controller_instance || request + headers[header_name(request)] = policy.build(context, nonce) end response @@ -257,7 +258,8 @@ module ActionDispatch #:nodoc: if context.nil? raise RuntimeError, "Missing context for the dynamic content security policy source: #{source.inspect}" else - context.instance_exec(&source) + resolved = context.instance_exec(&source) + resolved.is_a?(Symbol) ? apply_mapping(resolved) : resolved end else raise RuntimeError, "Unexpected content security policy source: #{source.inspect}" |