mrleo1nid/pipu-music
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 30 Wiki Activity

fix(uploads): hash files without WebAssembly under strict CSP
ci / contract / contract (сгенерированный код совпадает с openapi.yaml) (push) Successful in 3m17s
Details
ci / mobile / mobile (Metro-бандл Android) (push) Successful in 3m12s
Details
ci / docker / docker (образы собираются — их сервер собирает сам при обновлении) (push) Successful in 1m42s
Details
ci / ts / ts (packages + web) (push) Failing after 4m37s
Details
ci / module boundaries / boundaries (push) Successful in 5s
Details
ci / desktop / rust (desktop proxy) (push) Successful in 6m12s
Details

Browse Source
This commit is contained in:
mrleo1nid committed 2026-10-29 00:05:49 +03:00
1 parent f59d1e8d03
commit b39e4dc28f
7 files changed
+58 -45
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

deploy/nginx/security-headers.conf
+1 -2
View File
@@ -3,5 +3,4 @@
add_header X-Content-Type-Options "nosniff" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header X-Frame-Options "DENY" always;
# hash-wasm считает SHA-256 загрузок в Web Worker; разрешаем WASM без JavaScript eval.
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'wasm-unsafe-eval'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob:; media-src 'self' blob:; font-src 'self' data:; connect-src 'self'; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'" always;