Add very bad Content-Security-Policy

ptcrealitylab · Sep 24, 2024 · f9f508c · f9f508c
1 parent d29cd20
commit f9f508c
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 0 deletions.
diff --git a/libraries/LocalUIApp.js b/libraries/LocalUIApp.js
@@ -34,6 +34,11 @@ class LocalUIApp {
         this.loadResources();
 
         this.app.use(cors());
+        this.app.use((req, res, next) => {
+            res.setHeader('Content-Security-Policy', `default-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' blob: *; style-src 'self' *; frame-src 'self' *;`);
+            next();
+        });
+
         this.app.use('/addons/sources', (req, res) => {
             res.send(this.sources);
         });

diff --git a/server.js b/server.js
@@ -368,6 +368,11 @@ var cheerio = require('cheerio');
 // allow requests from all origins. TODO make it dependent on the local network. this is important for security
 webServer.use(cors());
 
+webServer.use((req, res, next) => {
+    res.setHeader('Content-Security-Policy', `default-src 'self' *; script-src 'self' 'unsafe-inline' 'unsafe-eval' *; object-src 'self' blob: *; style-src 'self' *; frame-src 'self' *;`);
+    next();
+});
+
 // Image resizing library, not available on mobile
 let Jimp = null;
 if (!isLightweightMobile) {