Set a restrictive Content-Security-Policy for the app UI.

Signed-off-by: Anders Kaseorg <[email protected]>
zulip · Jan 25, 2024 · 9d08a13 · 9d08a13
1 parent f98d6d7
commit 9d08a13
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 0 deletions.
diff --git a/app/renderer/main.html b/app/renderer/main.html
@@ -2,6 +2,10 @@
 <html lang="en" class="responsive desktop">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'none'; connect-src 'self'; font-src 'self'; img-src 'self' data:; script-src 'self'; style-src 'self' 'unsafe-inline'"
+    />
     <meta name="viewport" content="width=device-width" />
     <title>Zulip</title>
     <link rel="stylesheet" href="css/fonts.css" />

diff --git a/app/renderer/network.html b/app/renderer/network.html
@@ -2,6 +2,10 @@
 <html lang="en" class="responsive desktop">
   <head>
     <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />
+    <meta
+      http-equiv="Content-Security-Policy"
+      content="default-src 'none'; connect-src 'self'; img-src 'self'; script-src 'self'; style-src 'self'"
+    />
     <meta name="viewport" content="width=device-width" />
     <title>Zulip - Network Troubleshooting</title>
     <link