fix: critical CSP problem (#391)

apache · Feb 14, 2025 · e1b3d26 · e1b3d26
1 parent 491f503
commit e1b3d26
Showing 1 changed file with 8 additions and 1 deletion.
diff --git a/themes/docsy/layouts/_default/baseof.html b/themes/docsy/layouts/_default/baseof.html
@@ -1,6 +1,13 @@
 <!doctype html>
 <html lang="{{ .Site.Language.Lang }}" class="no-js">
   <head>
+      <!-- To handle CSP policy -->
+      <meta http-equiv="Content-Security-Policy"
+            content="default-src 'self';
+                    style-src 'self' 'unsafe-inline' https://code.jquery.com https://cdn.jsdelivr.net;
+                    script-src 'self' https://code.jquery.com https://cdn.jsdelivr.net;
+                    font-src 'self' https://cdn.jsdelivr.net;
+                    img-src 'self' data:">
     {{ partial "head.html" . }}
   </head>
   <body class="td-{{ .Kind }}{{ with .Page.Params.body_class }} {{ . }}{{ end }}">
@@ -15,4 +22,4 @@
     </div>
     {{ partialCached "scripts.html" . }}
   </body>
-</html>
+</html>