mrleo1nid/pipu-music
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

fix(uploads): allow WebAssembly hashing under CSP
ci / ts / ts (packages + web) (push) Failing after 4m29s
Details
ci / desktop / rust (desktop proxy) (push) Successful in 5m54s
Details
ci / docker / docker (образы собираются — их сервер собирает сам при обновлении) (push) Successful in 3m23s
Details

Browse Source
This commit is contained in:
mrleo1nid committed 2026-10-28 23:34:42 +03:00
1 parent 17c85493b7
commit 17bb0e1846
3 files changed
+51 -2
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/nginx/security-headers.conf
+2 -1
View File
@@ -3,4 +3,5 @@
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Frame-Options "DENY" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
# hash-wasm считает SHA-256 загрузок в Web Worker; разрешаем WASM без JavaScript eval.
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;