Merge pull request #29 from anvelicon/pr/media-src

feat: add media-src to the default CSP
trezy · Jan 12, 2022 · 8993082 · 8993082
2 parents c5d2c8c + 461b40a
commit 8993082
Show file tree

Hide file tree

Showing 5 changed files with 5 additions and 0 deletions.
diff --git a/__tests__/buildCSPHeaders.js b/__tests__/buildCSPHeaders.js
@@ -17,6 +17,7 @@ const DEFAULT_CSP = {
 	'frame-src': '\'none\'',
 	'img-src': '\'self\'',
 	'manifest-src': '\'self\'',
+	'media-src': '\'self\'',
 	'object-src': '\'none\'',
 	'prefetch-src': '\'self\'',
 	'script-src': '\'self\'',

diff --git a/docs/api/contentSecurityPolicy.md b/docs/api/contentSecurityPolicy.md
@@ -15,6 +15,7 @@
 		"frame-src": "'none'",
 		"img-src": "'self'",
 		"manifest-src": "'self'",
+		"media-src": "'self'",
 		"object-src": "'none'",
 		"prefetch-src": "'self'",
 		"script-src": "'self'",

diff --git a/docs/configuration.md b/docs/configuration.md
@@ -16,6 +16,7 @@ nextSafe({
 		"frame-src": "'none'",
 		"img-src": "'self'",
 		"manifest-src": "'self'",
+		"media-src": "'self'",
 		"object-src": "'none'",
 		"prefetch-src": "'self'",
 		"script-src": "'self'",

diff --git a/lib/buildCSPHeaders.js b/lib/buildCSPHeaders.js
@@ -34,6 +34,7 @@ module.exports = function buildCSPHeaders(options = {}) {
 		'frame-src': getCSPDirective(contentSecurityPolicy['frame-src'], "'none'"),
 		'img-src': getCSPDirective(contentSecurityPolicy['img-src'], "'self'"),
 		'manifest-src': getCSPDirective(contentSecurityPolicy['manifest-src'], "'self'"),
+		'media-src': getCSPDirective(contentSecurityPolicy['media-src'], "'self'"),
 		'object-src': getCSPDirective(contentSecurityPolicy['object-src'], "'none'"),
 		'prefetch-src': getCSPDirective(contentSecurityPolicy['prefetch-src'], "'self'"),
 		'script-src': getCSPDirective(contentSecurityPolicy['script-src'], "'self'"),

diff --git a/lib/models/CSP.js b/lib/models/CSP.js
@@ -18,6 +18,7 @@
  * @property {CSPDirective} ['frame-src']
  * @property {CSPDirective} ['img-src']
  * @property {CSPDirective} ['manifest-src']
+ * @property {CSPDirective} ['media-src']
  * @property {CSPDirective} ['object-src']
  * @property {CSPDirective} ['prefetch-src']
  * @property {CSPDirective} ['script-src']