diff options
Diffstat (limited to 'app/controllers/concerns')
| -rw-r--r-- | app/controllers/concerns/clientside_preview_csp.rb | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/app/controllers/concerns/clientside_preview_csp.rb b/app/controllers/concerns/clientside_preview_csp.rb new file mode 100644 index 00000000000..6892c441b67 --- /dev/null +++ b/app/controllers/concerns/clientside_preview_csp.rb @@ -0,0 +1,17 @@ +# frozen_string_literal: true + +module ClientsidePreviewCSP + extend ActiveSupport::Concern + + included do + content_security_policy do |p| + next if p.directives.blank? + next unless Gitlab::CurrentSettings.web_ide_clientside_preview_enabled? + + default_frame_src = p.directives['frame-src'] || p.directives['default-src'] + frame_src_values = Array.wrap(default_frame_src) | [Gitlab::CurrentSettings.web_ide_clientside_preview_bundler_url].compact + + p.frame_src(*frame_src_values) + end + end +end |