diff options
| author | Stephen Solis <stephsolis@gmail.com> | 2018-04-12 12:12:09 -0400 |
|---|---|---|
| committer | Stephen <stephen@nowhere> | 2018-04-12 12:44:11 -0400 |
| commit | 01d857b09ae22174d5101a03b424829a876cc4bd (patch) | |
| tree | 7061730665a01cbd67de9039cd180ceab23b1004 /actionpack | |
| parent | 5b7de1b70156ed0861e494ab9900c6b87c206a67 (diff) | |
| download | rails-01d857b09ae22174d5101a03b424829a876cc4bd.tar.gz rails-01d857b09ae22174d5101a03b424829a876cc4bd.tar.bz2 rails-01d857b09ae22174d5101a03b424829a876cc4bd.zip | |
Add WebSocket URI support to CSP DSL mappings
Diffstat (limited to 'actionpack')
| -rw-r--r-- | actionpack/lib/action_dispatch/http/content_security_policy.rb | 4 | ||||
| -rw-r--r-- | actionpack/test/dispatch/content_security_policy_test.rb | 6 |
2 files changed, 9 insertions, 1 deletions
diff --git a/actionpack/lib/action_dispatch/http/content_security_policy.rb b/actionpack/lib/action_dispatch/http/content_security_policy.rb index a3407c9698..c1f80a1ffc 100644 --- a/actionpack/lib/action_dispatch/http/content_security_policy.rb +++ b/actionpack/lib/action_dispatch/http/content_security_policy.rb @@ -113,7 +113,9 @@ module ActionDispatch #:nodoc: blob: "blob:", filesystem: "filesystem:", report_sample: "'report-sample'", - strict_dynamic: "'strict-dynamic'" + strict_dynamic: "'strict-dynamic'", + ws: "ws:", + wss: "wss:" }.freeze DIRECTIVES = { diff --git a/actionpack/test/dispatch/content_security_policy_test.rb b/actionpack/test/dispatch/content_security_policy_test.rb index f133aae865..95fce39dad 100644 --- a/actionpack/test/dispatch/content_security_policy_test.rb +++ b/actionpack/test/dispatch/content_security_policy_test.rb @@ -51,6 +51,12 @@ class ContentSecurityPolicyTest < ActiveSupport::TestCase @policy.script_src :strict_dynamic assert_equal "script-src 'strict-dynamic'", @policy.build + @policy.script_src :ws + assert_equal "script-src ws:", @policy.build + + @policy.script_src :wss + assert_equal "script-src wss:", @policy.build + @policy.script_src :none, :report_sample assert_equal "script-src 'none' 'report-sample'", @policy.build end |