fix: fix policies complaints (#147)

Author: dottmp

src/hooks.server.ts

@@ -3,6 +3,19 @@ import { sequence } from '@sveltejs/kit/hooks';
 
 import { dev } from '$app/environment';
 
+const csp = {
+	'default-src': ['self'],
+	'script-src': ['self'],
+	'style-src': ['self', 'unsafe-hashes', 'sha256-S8qMpvofolR8Mpjy4kQvEm7m1q8clzU4dfDH0AmvZjo='],
+	'font-src': ['self'],
+	'img-src': ['self', 'data:', 'https:'],
+	'connect-src': ['self'],
+	'object-src': ['none'],
+	'base-uri': ['self'],
+	'form-action': ['self'],
+	'frame-ancestors': ['none']
+};
+
 const handleHeaders: Handle = async ({ event, resolve }) => {
 	const headers: Record<string, string> = {
 		'X-Frame-Options': 'DENY',
@@ -18,7 +31,12 @@ const handleHeaders: Handle = async ({ event, resolve }) => {
 		headers['Strict-Transport-Security'] = 'max-age=31536000; includeSubDomains';
 	}
 
-	event.locals.securityHeaders = headers;
+	event.locals.securityHeaders = {
+		...headers,
+		['Content-Security-Policy']: Object.entries(csp)
+			.map(([directive, sources]) => `${directive} ${sources.join(' ')}`)
+			.join('; ')
+	};
 
 	const response = await resolve(event);
 

src/lib/features/awesome-privacy/components/search.svelte

@@ -157,7 +157,10 @@
 
 		function handler() {
 			const hv = window.visualViewport ? window.visualViewport.height : window.innerHeight;
+
 			keyboardHeight = Math.max(0, initial - hv);
+
+			document.documentElement.style.setProperty('--kb-height', `${keyboardHeight}px`);
 		}
 
 		if (window.visualViewport) {
@@ -266,10 +269,7 @@
 			</label>
 
 			<!-- Results  -->
-			<div
-				class="flex-1 overflow-y-auto [scrollbar-width:thin]"
-				style="margin-bottom: {keyboardHeight}px"
-			>
+			<div class="mb-[var(--kb-height,0px)] flex-1 overflow-y-auto [scrollbar-width:thin]">
 				{#snippet entryList(entries: SearchEntry[])}
 					<ul role="listbox" class="space-y-2 p-2">
 						{#each entries as entry (entry.href)}

src/routes/security/+page.ts

@@ -9,7 +9,11 @@ const config = {
 			directives: {
 				'default-src': ['self'],
 				'script-src': ['self'],
-				'style-src': ['self'],
+				'style-src': [
+					'self',
+					'unsafe-hashes',
+					'sha256-S8qMpvofolR8Mpjy4kQvEm7m1q8clzU4dfDH0AmvZjo='
+				],
 				'font-src': ['self'],
 				'img-src': ['self', 'data:', 'https:'],
 				'connect-src': ['self'],