public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Modify Content-Security-Policy for Swagger UI (#63568)

Browse Source 
* Modify Content-Security-Policy for Swagger UI

* check if CSP is empty

Co-authored-by: João Calisto <joao.calisto@grafana.com>

* check if CSP is empty in swagger.go

---------

Co-authored-by: João Calisto <joao.calisto@grafana.com>
Co-authored-by: Sofia Papagiannaki <1632407+papagian@users.noreply.github.com>
This commit is contained in:
Kristian Bremberg
2023-08-01 11:27:44 +03:00
committed by GitHub
co-authored by João Calisto Sofia Papagiannaki
parent 1869da1d86
commit 9b4dde7430
4 changed files with 30 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
pkg/api/openapi3.go
+12 -1
View File
@@ -2,10 +2,21 @@ package api
import (
"net/http"
"strings"
contextmodel "github.com/grafana/grafana/pkg/services/contexthandler/model"
)
func openapi3(c *contextmodel.ReqContext) {
c.HTML(http.StatusOK, "openapi3", nil)
data := map[string]interface{}{
"Nonce": c.RequestNonce,
}
// Add CSP for unpkg.com to allow loading of Swagger UI assets
if existingCSP := c.Resp.Header().Get("Content-Security-Policy"); existingCSP != "" {
newCSP := strings.Replace(existingCSP, "style-src", "style-src https://unpkg.com/", 1)
c.Resp.Header().Set("Content-Security-Policy", newCSP)
}
c.HTML(http.StatusOK, "openapi3", data)
}