From 592d9bcbdaf89484d4db3e72af3dde9c20c24a84 Mon Sep 17 00:00:00 2001 From: Joe Previte Date: Thu, 9 Sep 2021 17:51:39 -0700 Subject: [PATCH] fix(lib/vscode): update csp in webview to allow ports With #3895, we caused a regression where the Content-Security-Policy prevented images in the previewer to not work due to the ports in the resource URI. This modifies the CSP in the webview to make sure images are not blocked by CSP. I assume once we upgrade VS Code, we will revert this change. --- lib/vscode/src/vs/workbench/api/common/shared/webview.ts | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/lib/vscode/src/vs/workbench/api/common/shared/webview.ts b/lib/vscode/src/vs/workbench/api/common/shared/webview.ts index c0449b6f1..0a6a1e723 100644 --- a/lib/vscode/src/vs/workbench/api/common/shared/webview.ts +++ b/lib/vscode/src/vs/workbench/api/common/shared/webview.ts @@ -24,7 +24,10 @@ export const webviewResourceBaseHost = 'vscode-webview.net'; export const webviewRootResourceAuthority = `vscode-resource.${webviewResourceBaseHost}`; -export const webviewGenericCspSource = `https://*.${webviewResourceBaseHost}`; +// NOTE@coder: This is a temporary change to include ":*" +// due to the patch we had to make for webview resources. +// See PR#3895 and https://github.com/cdr/code-server/issues/3936 for more details. +export const webviewGenericCspSource = `https://*.${webviewResourceBaseHost}:*`; /** * Construct a uri that can load resources inside a webview