CodeCow/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2026-06-21 21:32:29 +08:00
Code Issues Actions Packages Projects Releases Wiki Activity

uploads: Change Content-Security-Policy to fix issue with pdf's.

Browse Source 
Our recent addition of Content-Security-Policy to the file uploads
backend broke in-browser previews of PDFs.

The content-types change in the last commit fixed loading PDFs for
most users; but the result was ugly, because e.g. Chrome would put the
PDF previewer into a frame (so there were 2 left scrollbars).

There were two changes needed to fix this:
* Loading the style to use the plugin.  We corrected this by adding
  `style-src 'self' 'unsafe-inline';`
* Loading the plugin.  Our CSP blocked loading the PDf viewer plugin.
  To correct this, we add object-src 'self', and then limit the
  plugin-type to just the one for application/pdf.

We verified this new CSP using https://csp-evaluator.withgoogle.com/
in addition to manual testing.
This commit is contained in:
Aditya Bansal 2018-04-16 16:08:27 +05:30 committed by Tim Abbott
parent 568a12e254
commit 4898fe7ebc
2 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
puppet/zulip/files/nginx/zulip-include-maybe/uploads-route.direct
View File

@ -1,6 +1,6 @@
location /user_uploads {
add_header X-Content-Type-Options nosniff;
add_header Content-Security-Policy "default-src 'none' img-src 'self'";
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
include /etc/nginx/zulip-include/uploads.types;
alias /home/zulip/uploads/files;
}

2
puppet/zulip/files/nginx/zulip-include-maybe/uploads-route.internal
View File

@ -1,7 +1,7 @@
location /serve_uploads {
internal;
add_header X-Content-Type-Options nosniff;
add_header Content-Security-Policy "default-src 'none' img-src 'self'";
add_header Content-Security-Policy "default-src 'none'; style-src 'self' 'unsafe-inline'; img-src 'self'; object-src 'self'; plugin-types application/pdf;";
include /etc/nginx/zulip-include/uploads.types;
alias /home/zulip/uploads/files;
}