github-mirrors/kibana
1
0
Fork 0
mirror of https://github.com/elastic/kibana.git synced 2025-04-24 17:59:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

Inject CSP config via HTML tag rather than inline JavaScript (#31514) (#31553)

Browse source 
This allows us to support a more flexible set of CSP rules that do not
necessarily rely on nonce.
This commit is contained in:
Court Ewing 2019-02-20 15:01:10 -05:00 • committed by GitHub
parent 3fc0a9edfb
commit ef82aaf7df
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
3 changed files with 5 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

4
src/ui/ui_render/bootstrap/template.js.hbs
View file

@ -1,3 +1,7 @@
var kbnCsp = JSON.parse(document.querySelector('kbn-csp').getAttribute('data'));
window.__kbnStrictCsp__ = kbnCsp.strictCsp;
window.__webpack_nonce__ = kbnCsp.nonce;
if (window.__kbnStrictCsp__ && window.__kbnCspNotEnforced__) { if (window.__kbnStrictCsp__ && window.__kbnCspNotEnforced__) {
var legacyBrowserError = document.getElementById('kbn_legacy_browser_error'); var legacyBrowserError = document.getElementById('kbn_legacy_browser_error');
legacyBrowserError.style.display = 'flex'; legacyBrowserError.style.display = 'flex';

1
src/ui/ui_render/views/chrome.pug
View file

@ -118,5 +118,6 @@ html(lang=locale)
style#themeCss style#themeCss
body body
kbn-csp(data=JSON.stringify({ nonce, strictCsp }))
kbn-injected-metadata(data=JSON.stringify(injectedMetadata)) kbn-injected-metadata(data=JSON.stringify(injectedMetadata))
block content block content

3
src/ui/ui_render/views/ui_app.pug
View file

@ -137,7 +137,4 @@ block content
// intentional as we check for the existence of __kbnCspNotEnforced__ in // intentional as we check for the existence of __kbnCspNotEnforced__ in
// bootstrap. // bootstrap.
window.__kbnCspNotEnforced__ = true; window.__kbnCspNotEnforced__ = true;
script(nonce=nonce).
window.__kbnStrictCsp__ = !{strictCsp};
window.__webpack_nonce__ = '!{nonce}';
script(src=bootstrapScriptUrl, nonce=nonce) script(src=bootstrapScriptUrl, nonce=nonce)